ICMP

ICMP (Internet Control Message Protocol) is a network-layer protocol that carries error messages and control information about IP packets. Unlike TCP and UDP, it does not move application data or set up connections. It is a signaling channel: it lets routers and computers tell a sender that a packet did not arrive, that a route has changed, that the packet’s time to live (TTL) expired, or that a host is unreachable. ICMP for IPv4 is described in RFC 792, and its messages are wrapped in IP packets with protocol number 1.

How does ICMP work?

ICMP keeps no connections. When a network device — a router, firewall, or destination host — runs into a problem handling an IP packet, it creates an ICMP message and sends it back to the source. This happens, for example, when a router has no route to the destination network, or when a packet needs to be split into smaller pieces but splitting is forbidden.

The message holds a header plus a piece of the packet that caused the error (usually the IP header and the first few bytes of data). That way the sender knows exactly which transmission the error refers to.

Every ICMP message starts with three header fields:

• Type (8 bits) — the general kind of message, such as Echo Request or Destination Unreachable.
• Code (8 bits) — refines the type, for example why a host is unreachable.
• Checksum (16 bits) — a checksum over the whole message.

After that come type-dependent fields (such as the identifier and sequence number in echo messages) and data.

What are ICMP types and codes?

The Type and Code pair defines exactly what a message means. The most important IPv4 types are:

• Type 0 — Echo Reply and Type 8 — Echo Request: the pair used by the ping command to check whether a host responds.
• Type 3 — Destination Unreachable: the packet could not be delivered. Codes give the reason, including Code 0 (network unreachable), Code 1 (host unreachable), Code 2 (protocol unreachable), Code 3 (port unreachable), and Code 4 (the packet must be split, but the DF bit, which forbids splitting, is set). The last one is essential to Path MTU Discovery, which finds the largest packet size allowed along a route.
• Type 5 — Redirect: a router suggests a better route to the destination.
• Type 11 — Time Exceeded: the packet’s time to live (TTL) reached zero (Code 0), or fragment reassembly timed out (Code 1). This message is what makes traceroute work.
• Type 12 — Parameter Problem: an error in the IP packet header.

The historical Type 4 — Source Quench (a request to slow down) has been deprecated. The IANA organization maintains the full registry of types and codes.

What is ICMP used for in practice?

ICMP is behind two basic diagnostic tools:

• ping — sends an Echo Request (Type 8) and waits for an Echo Reply (Type 0). It checks whether a host responds, measures the round-trip time (RTT), and detects lost packets.
• traceroute / tracert — sends packets with a gradually increasing TTL and reads the Time Exceeded messages (Type 11) returned by each router along the way. This reconstructs the packet’s path to the destination. On Unix-like systems traceroute sends UDP probes by default, while Windows tracert sends ICMP Echo packets, but in both cases the replies from intermediate routers rely on ICMP.

Beyond diagnostics, ICMP supports Path MTU Discovery (finding the largest packet size along a route) and passes routing-error information to routers and hosts.

How does ICMPv6 differ from ICMP for IPv4?

In IPv6 networks the equivalent is ICMPv6, described in RFC 4443 and carried as protocol number 58. It does the same error-signaling job, but it is far more important to IPv6 itself — it takes over tasks that separate protocols handled in IPv4:

• Neighbor Discovery (ND) — replaces the ARP protocol; it maps IPv6 addresses to link-layer addresses (Neighbor Solicitation / Advertisement).
• Router Discovery — Router Solicitation / Advertisement messages allow addresses to be set automatically (SLAAC).
• Multicast Listener Discovery (MLD) — manages multicast group membership.

For this reason, blocking all ICMPv6 too aggressively at firewalls can break core IPv6 functions. In IPv4 you can filter ICMP more strictly, because it handles fewer critical tasks there.

Why does ICMP matter for security?

ICMP is a supporting protocol, but its simplicity and presence in almost every network make it an attractive target for abuse. To a defender it is at once a reconnaissance tool in an attacker’s hands, an attack channel, and a valuable source of monitoring data.

Reconnaissance

Attackers use Echo Requests to find live hosts (a ping sweep). From Destination Unreachable and Time Exceeded messages they infer how a network is built, what the firewall rules are, and whether filters are present. What replies — or what is missing — shows which addresses and ports are reachable.

Volumetric attacks (DoS/DDoS)

• ICMP flood (ping flood) — flooding a target with Echo Request packets faster than it can reply, which saturates bandwidth and loads the CPU.
• Smurf attack — sending Echo Requests to a network’s broadcast address with the victim’s spoofed source address. Every host replies to the victim, multiplying the traffic (amplification).
• Ping of Death — sending malformed or over-split ICMP packets that exceed the allowed size once reassembled, crashing a vulnerable network stack. Today this is mostly a historical threat.

Tunneling and data theft

ICMP tunneling hides arbitrary data inside the data field of Echo Request/Reply packets. Because ICMP is often allowed through firewalls for diagnostics, this channel is used to covertly control infected machines (command and control) and to steal data in a way that is hard to spot without inspecting packet contents. Telltale signs include unusually large ICMP packets, a high and steady volume of echo traffic to a single external host, and ICMP sent to places that are not normally pinged.

Relevance to monitoring and the SOC

For SOC teams and NDR systems, ICMP is both traffic to filter and a source of valuable data. Common defensive practices include:

• rate-limiting ICMP messages rather than blocking them entirely — a full block breaks Path MTU Discovery and diagnostics;
• filtering ICMP at the network edge by type (for example, selectively allowing Time Exceeded and Fragmentation Needed);
• analyzing the size and frequency of ICMP data for signs of tunneling;
• linking unusual ICMP events (sudden ping sweeps, spikes in Destination Unreachable) with other signals in the network.

Learn more

• ARP Spoofing / Poisoning — ICMP error messages can reveal hosts affected by ARP spoofing or poisoned routes.
• Microsegmentation — Microsegmentation can limit ICMP traffic between segments to reduce attack paths.
• Scrubbing Center — Scrubbing centers often filter ICMP floods during DDoS mitigation.
• Protocol Attack — ICMP is commonly abused in protocol attacks to exhaust network or device resources.
• North-South vs East-West Traffic — ICMP may appear in both north-south and east-west traffic for reachability checks.
• Amplification Attack — ICMP can be used in amplification attacks when small requests trigger larger replies.
• Reflection Attack — ICMP reflection attacks spoof the victim’s address to redirect replies to it.
• Secure Access Service Edge (SASE) — SASE policies can inspect or restrict ICMP to control connectivity and attack surface.