What Is ICMP and How Does Ping Work?
Table of Contents
What ICMP Does
ICMP (Internet Control Message Protocol) is the error reporting and diagnostic protocol of the IP suite. It does not carry application data. Instead, it carries messages about the network itself: "this host is unreachable," "this port is closed," "this packet was too big for this link," "you need to slow down."
ICMP operates at the network layer (Layer 3), alongside IP. ICMP messages are encapsulated inside IP packets with protocol number 1. Despite being part of the IP suite, ICMP is not a transport protocol - it does not establish connections or carry user data.
Every IP implementation includes ICMP. Routers use it to report problems. Hosts use it for diagnostics. Network administrators use it through tools like ping and traceroute. It is one of the oldest and most fundamental internet protocols.
ICMP Message Types
ICMP messages are identified by a type number and a code number. The type defines the general category, the code provides specifics within that category. The most important types:
- Type 0 - Echo Reply: response to a ping (paired with Type 8)
- Type 3 - Destination Unreachable: the packet could not be delivered. Codes specify why: network unreachable (0), host unreachable (1), port unreachable (3), fragmentation needed but DF set (4)
- Type 5 - Redirect: tells a host to use a different gateway for a specific destination
- Type 8 - Echo Request: a ping request
- Type 11 - Time Exceeded: the TTL reached zero (used by traceroute) or fragment reassembly time exceeded
Type 3 Code 3 (Port Unreachable) is what you receive when you send a UDP packet to a closed port. This is how UDP port scans work - if you get a Port Unreachable response, the port is closed. No response means the port might be open (or the response was filtered).
How Ping Works
Ping is the simplest network diagnostic tool. It sends an ICMP Echo Request (Type 8) to a target host and waits for an ICMP Echo Reply (Type 0). If the reply arrives, the host is reachable and the round-trip time is measured.
The Echo Request contains an identifier (so the sender can match replies to requests), a sequence number (so multiple pings can be tracked), and optional payload data. The Echo Reply copies all of this back, allowing the sender to verify the response matches the request and calculate latency.
What ping tells you:
- Reachability - the target host is alive and its network path is functional
- Latency - the round-trip time in milliseconds
- Packet loss - what percentage of requests get no reply (indicating network problems)
- Jitter - variation in round-trip time (important for real-time applications)
What ping does not tell you: whether a specific service is running, whether the host is accepting TCP connections, or whether a firewall is filtering other protocols. Many hosts and firewalls block ICMP while allowing all other traffic, so a failed ping does not necessarily mean the host is down.
sequenceDiagram
participant You
participant R1 as Router 1
participant R2 as Router 2
participant DST as Destination
You->>R1: Packet (TTL=1)
R1->>You: Time Exceeded
You->>R2: Packet (TTL=2)
R2->>You: Time Exceeded
You->>DST: Packet (TTL=3)
DST->>You: Echo Reply
How Traceroute Works
Traceroute maps the path packets take from your device to a destination by exploiting the TTL (Time To Live) field in the IP header. Each router that handles a packet decrements the TTL by 1. When the TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded (Type 11) message back to the sender.
Traceroute works by sending packets with incrementally increasing TTL values:
- Send a packet with TTL=1. The first router decrements it to 0 and replies with Time Exceeded. Now you know the first hop's IP address and latency.
- Send a packet with TTL=2. The first router decrements to 1 and forwards. The second router decrements to 0 and replies. Now you know the second hop.
- Continue increasing TTL until the packet reaches the destination (which responds with an Echo Reply or Port Unreachable instead of Time Exceeded).
The output is a list of every router between you and the destination, with latency measurements for each hop. This reveals where slowdowns, packet loss, or routing anomalies occur along the path.
On Linux and macOS, traceroute sends UDP packets by default. On Windows, tracert uses ICMP Echo Requests. Both approaches use the same TTL-based discovery mechanism.
ICMP as an Attack Surface
ICMP has been used in several types of attacks:
Ping flood - overwhelming a target with ICMP Echo Requests. The target spends resources processing and responding to each request. With enough bandwidth, this can saturate the target's network link or exhaust its CPU.
Ping of Death - sending a malformed ICMP packet larger than the maximum IP packet size (65,535 bytes). Older operating systems crashed when trying to reassemble the oversized packet. This was patched decades ago but is historically significant.
Smurf attack - sending ICMP Echo Requests with a spoofed source address (the victim's IP) to a broadcast address. Every device on the broadcast network responds to the victim simultaneously, amplifying the attacker's bandwidth. Modern networks block directed broadcast by default, making this largely obsolete.
ICMP redirect attacks - sending forged ICMP Redirect messages to reroute a host's traffic through the attacker. Most modern operating systems ignore ICMP redirects by default.
ICMP tunneling - encoding data in the payload of ICMP Echo Request/Reply packets to create a covert communication channel. Since ICMP is often allowed through firewalls, this can bypass egress filtering. Tools like icmpsh and ptunnel implement this.
Should You Block ICMP?
Blocking all ICMP is a common but problematic practice. Blocking Echo Request prevents ping, which reduces reconnaissance but also breaks legitimate diagnostics. Blocking Type 3 Code 4 (Fragmentation Needed) breaks Path MTU Discovery and causes mysterious connection failures for large packets. Blocking Time Exceeded breaks traceroute.
A better approach is selective ICMP filtering: allow the types needed for network functionality (Type 3, Type 11) and rate-limit or block types that are primarily used for attacks (unlimited Echo Requests, Redirects).
For wireless security testing, ICMP behavior reveals firewall and network configuration. If ping works to the gateway but not to external hosts, the network may have outbound filtering. If traceroute shows the path, the network topology is partially visible. The BLEShark Nano's network reconnaissance operates at Layer 2 (WiFi and BLE frames), which is below ICMP, but understanding ICMP helps interpret the network environment once a connection is established.