01 Internet Control Message Protocol (ICMP)
ICMP is a network layer protocol used by network devices to diagnose network communication issues. It is primarily used to send error messages and operational information indicating success or failure when communicating with another IP address.
Protocol Characteristics
- ▸ Layer 3 (Network Layer) protocol
- ▸ Encapsulated in IP datagrams (Protocol Type = 1)
- ▸ Unreliable - no acknowledgment mechanism
- ▸ Used by ping, traceroute utilities
Common ICMP Types
ICMP Packet Structure
| Field | Size | Description |
|---|---|---|
| Type | 8 bits | Identifies the ICMP message type |
| Code | 8 bits | Provides additional context for Type |
| Checksum | 16 bits | Error-checking for header and data |
| Identifier | 16 bits | Used to match requests with replies |
| Sequence Number | 16 bits | Sequence of echo requests/replies |
| Data | Variable | Payload (typically timestamp + data) |
Educational Note
ICMP is essential for network troubleshooting but can also be exploited for attacks (e.g., ICMP flood, Smurf attack). Understanding ICMP helps in both network diagnostics and security implementation. The Ping of Death attack exploited ICMP by sending malformed oversized packets.