ICMP

Internet Control Message Protocol carries control, error, and diagnostic information alongside IP. ICMP for IPv4 and ICMPv6 are related but distinct protocols with different message type numbers and responsibilities.

Types, Codes, and Checksums

An ICMP message has a type, a more-specific code where applicable, and a checksum. Error messages normally include part of the packet that triggered them so the sender can associate the error with a flow.

Echo and Error Messages

For ICMPv4, Echo Request is type 8 and Echo Reply type 0. Destination Unreachable is type 3, and Time Exceeded is type 11. ICMPv6 uses different type numbers, so always identify the address family before interpreting a capture.

Path MTU and Essential ICMP

ICMP is not merely optional ping traffic. IPv4 fragmentation-needed errors and ICMPv6 Packet Too Big messages support Path MTU Discovery. ICMPv6 also carries Neighbor Discovery and Router Advertisements. Blocking all ICMP can therefore create black holes and break IPv6 operation.

Filter by required type, direction, rate, and scope instead of applying a blanket assumption. Attackers can spoof some ICMP, so validate quoted packet context and corroborate with local routes and captures.

Interpreting Silence

No ICMP response can mean filtering, rate limiting, asymmetric routing, a missing return route, a down host, or a device that simply does not answer that message. Conversely, an ICMP error can be generated by an intermediate device rather than the final destination.

Summary

You can now interpret ICMP as control evidence rather than a binary connectivity verdict.

1. Read type and code in the correct IP family.
2. Recognize echo, unreachable, and time-exceeded roles.
3. Preserve ICMP needed for path MTU and IPv6 operation.
4. Correlate errors and silence with other path evidence.