Internet Control Message Protocol
ActiveSupporting protocol in the Internet Protocol suite used by network devices to report errors and operational information about IP packet processing.
In one line
ICMP is the error-reporting and diagnostic protocol of the Internet Protocol suite, defined in RFC 792. It operates at the network layer (IP), not transport layer, and carries control messages like Destination Unreachable, Time Exceeded, and Echo Request/Reply (ping). ICMP has no port numbers – it uses message types and codes instead.
Quick Reference
| Field | Size | Description |
|---|---|---|
| Type | 8 bits | Message type (8=Echo Request, 0=Echo Reply, 3=Dest. Unreachable, 11=Time Exceeded) |
| Code | 8 bits | Sub-type of the message. Further specifies the Type. |
| Checksum | 16 bits | Error detection for the ICMP message |
| Rest | 32 bits | Depends on type/code (Identifier + Sequence for Echo, unused for others) |
| Data | Variable | For Echo: arbitrary data. For errors: original IP header + 8 bytes of datagram. |
Key Characteristics
Error Reporting
Reports packet delivery failures back to the source.
Diagnostic
Powers ping (Echo) and traceroute (Time Exceeded).
Network Layer
Carried inside IP packets – no transport layer ports.
Not Reliable
ICMP messages themselves may be lost without notification.
Implementations
Edge cases
- •Firewalls often block ICMP, breaking ping and some traceroute implementations.
- •ICMP rate limiting can cause false packet loss in monitoring tools.
- •ICMP redirect messages (Type 5) can be abused for routing attacks.
- •Fragment Needed (Type 3, Code 4) is critical for Path MTU Discovery.
History
ICMP was defined in RFC 792 (1981) alongside the original IP specification. ICMPv6 was later defined in RFC 4443 for IPv6, absorbing ARP functionality into Neighbor Discovery Protocol (NDP).