1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain what ICMP is and why networks use it.
• Understand ICMP Echo Request and Echo Reply messages.
• Use the ping command to test network reachability.
• Understand how traceroute and tracert discover network paths.
• Explain TTL (Time To Live) and hop counts.
• Recognize common ICMP error messages.
• Troubleshoot basic network connectivity problems.
• Understand ICMP-related security risks.
• Apply appropriate ICMP filtering and monitoring practices.

2. What Is ICMP?

ICMP stands for Internet Control Message Protocol.

ICMP is a network-layer protocol used by devices such as computers and routers to communicate network errors, diagnostic information, and operational messages.

It helps devices understand what is happening when packets travel across an IP network.

For example:

• Is another device reachable?
• Is a destination network unavailable?
• Has a packet exceeded its allowed lifetime?
• Is a router unable to forward a packet?
• Is a network path experiencing problems?

ICMP is commonly used by tools such as:

• Ping
• Traceroute
• Tracert
• Path MTU Discovery mechanisms

2.1 Where Does ICMP Work?

ICMP works alongside IP at the network layer.

In the TCP/IP model, it belongs to the Internet layer.

Unlike TCP and UDP, ICMP does not use TCP or UDP port numbers.

Important: ICMP messages are carried inside IP packets. ICMP itself does not establish a TCP-style connection.

2.2 ICMP for IPv4 and IPv6

There are two important versions:

ICMPv6 is particularly important because IPv6 uses it for functions such as Neighbor Discovery and Path MTU Discovery.

Blocking all ICMPv6 traffic can break important IPv6 network functionality.

3. ICMP Message Structure

An ICMP message generally contains:

• Type
• Code
• Checksum
• Additional fields depending on the message type
• Optional message data

3.1 Type and Code

The Type identifies the broad category of an ICMP message.

The Code provides additional information about that message.

Examples:

These values refer to common ICMPv4 messages. ICMPv6 uses a different type-numbering system.

4. ICMP Echo Request and Echo Reply

The most familiar use of ICMP is checking whether a destination responds to an Echo Request.

Two messages are involved:

Echo Request: A device asks another device to respond.

Echo Reply: The destination responds to the request.

Example

Suppose your computer has this IP address:

192.168.1.10

Your router has this IP address:

192.168.1.1

When you run:

ping 192.168.1.1

The following process takes place:

1. Your computer creates an ICMP Echo Request.
2. The request is encapsulated inside an IP packet.
3. The packet travels to the destination.
4. If the router accepts and processes the request, it generates an Echo Reply.
5. Your computer receives the reply.
6. The ping utility reports the result and response time.

What Does Ping Actually Confirm?

A successful ping generally indicates that:

• The destination responded to the ICMP Echo Request.
• A network path existed for the request and reply.
• The measured round-trip time can be calculated.

However, a successful ping does not prove that:

• Every application on the destination is working.
• A web server is healthy.
• A particular TCP port is open.
• The destination is free from security vulnerabilities.

Key concept: Ping tests ICMP reachability, not complete application availability.

5. Understanding the Ping Command

Ping is a command-line utility used to test network reachability and measure round-trip time.

5.1 Windows Ping

ping 192.168.1.1

Example output:

Pinging 192.168.1.1 with 32 bytes of data:

Reply from 192.168.1.1: bytes=32 time=2ms TTL=64
Reply from 192.168.1.1: bytes=32 time=3ms TTL=64
Reply from 192.168.1.1: bytes=32 time=2ms TTL=64
Reply from 192.168.1.1: bytes=32 time=2ms TTL=64

Ping statistics:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

5.2 Understanding the Output

5.3 Common Ping Results

Successful response

Reply from 192.168.1.1: bytes=32 time=2ms TTL=64

The destination responded.

Request timed out

Request timed out.

No reply was received within the configured timeout.

Possible causes:

• Destination is offline.
• ICMP is blocked.
• A firewall drops the request or response.
• Network connectivity is interrupted.
• The destination is configured not to respond.

Destination host unreachable

Destination host unreachable.

A device or router reports that it cannot deliver the packet to the destination.

Possible causes include missing routes, local neighbor-resolution problems, or an unreachable network.

Important: A failed ping does not automatically mean the target is offline. ICMP filtering is common in production networks.

6. Useful Ping Commands

Windows

Test a local gateway:

ping 192.168.1.1

Test a public IP address:

ping 1.1.1.1

Send a specific number of requests:

ping -n 5 192.168.1.1

Continuously test connectivity:

ping -t 192.168.1.1

Set a packet size:

ping -l 1000 192.168.1.1

Linux and macOS

Test a gateway:

ping 192.168.1.1

Send five requests:

ping -c 5 192.168.1.1

Set a packet size:

ping -s 1000 192.168.1.1

Stop a continuous ping:

Ctrl + C

Use these commands only against your own devices or destinations where diagnostic testing is permitted.

7. What Is TTL?

TTL stands for Time To Live.

In IPv4, TTL is an 8-bit field in the IP header.

It limits how long a packet can remain in circulation.

Each router that forwards an IPv4 packet decreases its TTL by at least one.

When TTL reaches zero, the router discards the packet and typically sends an ICMP Time Exceeded message to the sender.

7.1 Why Is TTL Important?

Without a packet-lifetime limit, routing loops could cause packets to circulate indefinitely.

TTL helps prevent this problem.

Example:

Suppose a packet starts with TTL 4.

The packet is discarded when its TTL expires.

7.2 TTL in Ping Output

Example:

Reply from 192.168.1.1: bytes=32 time=2ms TTL=64

The displayed TTL is the value in the reply packet when it reaches your computer.

It is not necessarily the original TTL.

Different operating systems and devices may start with different initial TTL values. Therefore, TTL is not a reliable way to identify a device or operating system on its own.

7.3 TTL vs Hop Count

These concepts are related but different:

• TTL: A field that limits packet forwarding lifetime.
• Hop count: The number of routers a packet traverses.

Traceroute uses controlled TTL or Hop Limit values to discover the path through routers.

8. What Is Traceroute?

Traceroute is a network diagnostic utility that identifies the sequence of routers a packet passes through while travelling towards a destination.

It helps network administrators understand where delays or connectivity problems may occur.

Different operating systems provide different implementations.

• Windows: tracert
• Linux: traceroute
• macOS: traceroute

8.1 How Traceroute Works

Traceroute sends probe packets with gradually increasing TTL values.

Step 1: First probe

The sender transmits a packet with TTL 1.

The first router decreases the TTL to zero, discards the packet, and may send an ICMP Time Exceeded response.

Step 2: Second probe

Traceroute sends another packet with TTL 2.

The second router may respond when the TTL expires.

Step 3: Third probe

The next packet uses TTL 3 and may reveal the third router.

Step 4: Continue

The process repeats until the destination is reached or the tool reaches its configured limit.

The resulting output helps identify the path.

8.2 Example Traceroute Output

Tracing route to example.com

  1     2 ms     1 ms     2 ms  192.168.1.1
  2     8 ms     7 ms     9 ms  10.10.0.1
  3    15 ms    14 ms    16 ms  203.0.113.1
  4    22 ms    21 ms    23 ms  destination.example

Trace complete.

This is illustrative output using example addresses, not a live route.

Understanding the Columns

Multiple probes are commonly sent for each hop to help estimate response-time variation.

8.3 Asterisk (*) in Traceroute

Example:

  3     *        *        *     Request timed out

This does not necessarily mean that the network is broken.

Possible reasons:

• A router does not respond to traceroute probes.
• ICMP messages are filtered.
• A firewall blocks diagnostic traffic.
• A router rate-limits responses.
• A routing path changes during the test.

Traffic may still successfully reach the final destination even when some intermediate hops do not respond.

9. Tracert and Traceroute Commands

Windows

tracert example.com

Skip reverse DNS lookups:

tracert -d example.com

Set a maximum hop count:

tracert -h 20 example.com

Set a timeout:

tracert -w 1000 example.com

Linux

traceroute example.com

Use numeric addresses:

traceroute -n example.com

Set maximum hops:

traceroute -m 20 example.com

macOS

traceroute example.com

Technical note: Windows tracert commonly uses ICMP Echo Request probes. Traditional Linux and macOS traceroute commonly use UDP probes by default, although ICMP and TCP-based modes are also available. Their output and filtering behavior can therefore differ.

10. What Is ICMP Destination Unreachable?

ICMP Destination Unreachable is an error message indicating that a packet could not be delivered to its intended destination or service.

In IPv4, it uses ICMP Type 3 with different codes for different reasons.

Common examples:

10.1 Network Unreachable

A router does not have a usable route to the destination network.

10.2 Host Unreachable

The destination host cannot be reached through the available network path.

10.3 Port Unreachable

The destination host may be reachable, but the requested UDP port is unavailable or closed.

This can also be used by some traceroute implementations to indicate that the destination has been reached.

10.4 Fragmentation Needed

A router cannot forward a packet because it exceeds the outgoing link's supported packet size and fragmentation is not allowed.

This message is important for IPv4 Path MTU Discovery.

11. Other Important ICMP Messages

ICMP is not limited to ping and traceroute.

Other useful messages include:

Time Exceeded

Indicates that a packet's TTL expired or that fragment reassembly took too long.

Redirect

A router may inform a host that a better next-hop route is available. Modern network security configurations generally restrict or disable acceptance of untrusted redirects.

Parameter Problem

Indicates a problem with an IP header field.

Fragmentation Needed

Helps IPv4 devices discover the maximum packet size supported along a path.

In IPv6, ICMPv6 provides related error messages and essential functions such as Neighbor Discovery.

12. Network Troubleshooting Using Ping and Traceroute

Network administrators use these tools to narrow down connectivity problems.

Scenario 1: Cannot Reach the Local Gateway

Try:

ping 192.168.1.1

If it fails, investigate:

• Wi-Fi or Ethernet connection.
• IP configuration.
• Default gateway configuration.
• Local firewall rules.
• Switch, access point, or router connectivity.
• ARP or neighbor-resolution problems.

Scenario 2: Gateway Works, Internet IP Does Not

Try:

ping 192.168.1.1
ping 1.1.1.1

If the gateway responds but the public IP does not, possible causes include:

• Router's WAN connection failure.
• ISP connectivity problems.
• Missing or incorrect routes.
• Upstream firewall filtering.
• Destination ICMP filtering.

Scenario 3: IP Works, Domain Name Does Not

Try:

ping 1.1.1.1
nslookup example.com

If IP connectivity works but name resolution fails, investigate DNS configuration and DNS server availability.

Scenario 4: High Latency

Try:

ping -n 10 192.168.1.1
tracert example.com

Investigate:

• Local Wi-Fi interference.
• Network congestion.
• Routing changes.
• ISP issues.
• Packet loss.
• Destination-side filtering or congestion.

A high response time at one intermediate hop does not always mean that hop is responsible for end-to-end delay. Compare later hops and the final destination before drawing conclusions.

13. ICMP Security Risks

ICMP is useful, but attackers can also misuse it.

Understanding these threats helps defenders design appropriate controls.

13.1 ICMP Flood

An attacker sends a large volume of ICMP Echo Requests to consume network bandwidth or device resources.

Potential effects:

• Increased network congestion.
• Higher CPU utilization.
• Service degradation.
• Network availability problems.

Defense:

• Apply appropriate rate limiting.
• Use DDoS protection services where necessary.
• Monitor abnormal ICMP traffic volume.
• Coordinate filtering with network and ISP teams.

13.2 Ping Flood

A ping flood is a type of ICMP flood that uses large numbers of Echo Requests.

The goal is to overwhelm the target or consume available bandwidth.

Defense: Rate-limit or filter unnecessary Echo Requests while preserving required diagnostic functionality.

13.3 Smurf Attack

A Smurf attack abuses IP broadcast behavior.

Historically, an attacker sends ICMP Echo Requests to a network's broadcast address while spoofing the victim's source IP address.

Multiple devices may respond to the victim, amplifying traffic.

Defense:

• Prevent directed broadcasts from being forwarded where appropriate.
• Apply anti-spoofing ingress and egress filtering.
• Use appropriate network filtering.
• Monitor abnormal broadcast and ICMP activity.

13.4 ICMP Tunneling

ICMP packets contain data fields. Attackers may misuse those fields to transport unauthorized information through networks that permit ICMP.

This can be used for covert communication or data exfiltration.

Defense:

• Monitor unusual ICMP payload sizes and patterns.
• Restrict unnecessary outbound ICMP traffic.
• Investigate unexpected communication with external destinations.
• Use endpoint detection and network monitoring.

13.5 Network Reconnaissance

Attackers may use ping sweeps and traceroute to identify responsive devices and understand network paths.

These tools also have legitimate administrative uses.

Defense:

• Expose only necessary network services.
• Use firewall policies.
• Monitor unusual scanning patterns.
• Apply network segmentation.
• Avoid relying on ICMP blocking as the only security control.

14. ICMP Filtering and Defensive Best Practices

A firewall should not automatically block every ICMP message.

Some ICMP messages are important for normal network operation and troubleshooting.

Recommended approach

1. Allow necessary ICMP traffic for network diagnostics.
2. Rate-limit Echo Requests where appropriate.
3. Restrict unnecessary inbound ICMP based on the organization's security requirements.
4. Permit essential error messages needed for network operation.
5. Preserve required IPv4 and IPv6 Path MTU Discovery functionality.
6. Monitor unusual ICMP traffic patterns.
7. Apply anti-spoofing rules at network boundaries.
8. Document approved filtering policies.

ICMP vs ICMPv6 Filtering

ICMPv6 is essential to IPv6 operation.

Blindly blocking ICMPv6 can break:

• Neighbor Discovery.
• Router Discovery.
• Path MTU Discovery.
• Other IPv6 network functions.

Security principle: Filter ICMP based on message type, direction, source, destination, and operational requirements—not by blindly disabling the entire protocol.

15. Practical Lab 1: Test Local Network Reachability

Objective: Check whether your own computer can communicate with its local gateway.

Step 1: Find Your Gateway

Windows:

ipconfig

Linux:

ip route

macOS:

route -n get default

Identify the default gateway.

Step 2: Ping the Gateway

ping 192.168.1.1

Replace the example address with your actual gateway.

Step 3: Observe the Output

Record:

• Number of packets sent.
• Number of packets received.
• Packet loss percentage.
• Minimum response time.
• Maximum response time.
• Average response time.

Step 4: Explain the Result

Answer these questions:

1. Did the gateway respond?
2. Was there any packet loss?
3. What was the average round-trip time?
4. What could cause a failed response?

Expected outcome: Understand how ping helps verify local network reachability.

16. Practical Lab 2: Discover a Network Path

Objective: Observe the routers between your computer and an approved destination.

Use a public diagnostic destination or a server you are authorized to test.

Windows:

tracert example.com

Linux/macOS:

traceroute example.com

Tasks

1. Run traceroute.
2. Identify the first hop.
3. Identify the number of visible hops.
4. Observe the response times.
5. Look for any asterisk entries.
6. Explain why an intermediate router might not respond.
7. Compare the final destination response with the earlier hops.

Expected outcome: Understand how traceroute reveals portions of a network path.

17. Practical Lab 3: Analyze ICMP Packets in Wireshark

Objective: Observe ICMP communication in an authorized environment.

Steps

1. Open Wireshark.
2. Select your active network interface.
3. Start packet capture.
4. Run a ping against your own gateway.
5. Apply the display filter:

icmp

For ICMPv6:

icmpv6

Observe These Fields

• Source IP address.
• Destination IP address.
• ICMP Type.
• ICMP Code.
• Echo identifier.
• Sequence number.
• Packet length.

Tasks

1. Identify an Echo Request.
2. Identify its matching Echo Reply.
3. Compare their source and destination addresses.
4. Identify the ICMP Type and Code.
5. Observe how the TTL differs between the request and reply.

Expected outcome: Understand how ICMP messages appear inside captured IP traffic.

Only inspect traffic from your own device or an explicitly authorized lab.

18. Practical Lab 4: Troubleshooting Simulation

Scenario:

An employee reports:

"I can connect to office Wi-Fi, but I cannot access websites."

You have the following diagnostic results:

Ping Gateway: Successful
Ping 1.1.1.1: Successful
DNS Lookup: Failed

Your Task

Identify the most likely problem.

Investigation hints:

• Local network connectivity works.
• External IP connectivity works.
• Domain name resolution fails.

Expected conclusion: DNS resolution is the most likely issue.

Possible next checks:

ipconfig /all
nslookup example.com

Review the configured DNS server and its availability.

20. Lesson Summary

In this lesson, you learned:

• ICMP supports network diagnostics and error reporting.
• Ping uses ICMP Echo messages to test reachability.
• A successful ping does not guarantee that an application or TCP port is working.
• TTL limits the forwarding lifetime of IPv4 packets.
• Traceroute uses controlled probe values to discover network hops.
• Destination Unreachable and Time Exceeded messages help explain network failures.
• ICMP can be misused for flooding, reconnaissance, and covert communication.
• Appropriate rate limiting, filtering, monitoring, and anti-spoofing controls improve network security.
• ICMPv6 must be handled carefully because it supports essential IPv6 functionality.

21. Coming Next: Routing and Switching Fundamentals

In the next lesson, you will learn how switches forward frames inside a local network and how routers move packets between different networks.

Topics include:

• What is routing?
• What is switching?
• Routing tables and default routes.
• Static and dynamic routing.
• Layer-2 and Layer-3 switches.
• VLANs and trunking.
• Inter-VLAN routing.
• OSPF, RIP, and BGP fundamentals.
• Routing and switching security.

CYNARKS Academy – Learn to Understand. Practice to Defend.

Practice networking and security testing only on systems you own or have explicit authorization to test.