Module 13 — ICMP

What is ICMP?

The Internet Control Message Protocol (ICMP) is a Layer 3 protocol used by IP devices to send error messages and operational information. Unlike TCP or UDP, ICMP is not used to carry application data — it exists purely for diagnostics, error reporting, and network management.

IP by itself is an unreliable, best-effort delivery protocol. It has no built-in mechanism to inform a sender when a packet cannot be delivered. ICMP fills this gap. When a router cannot forward a packet, or when a TTL expires, ICMP generates a message back to the source, identifying the problem.

There are two versions: ICMPv4 for IPv4 networks and ICMPv6 for IPv6 networks. ICMPv6 includes all the error and echo functions of ICMPv4 plus additional features through Neighbor Discovery Protocol (NDP), which replaces ARP in IPv6.

An ICMP message consists of: a Type field (identifies the category of message), a Code field (sub-category within the type), a Checksum for error detection, and Data that varies by message type.

ICMPv4 Message Types

ICMPv4 defines many message types, but the CCNA exam focuses on three key categories: Echo Request/Reply (used by ping), Destination Unreachable, and Time Exceeded (used by traceroute).

Host Reachability — Echo Request and Echo Reply: When you run ping, your device sends an ICMP Type 8 (Echo Request) to the target. If the target is reachable and responding, it sends back an ICMP Type 0 (Echo Reply). This round-trip confirms the remote host is alive and the path is functioning.

Destination Unreachable (Type 3): Generated by a router or host when a packet cannot be delivered. Different codes identify exactly what went wrong: Code 0 = Network Unreachable (no route to the destination network), Code 1 = Host Unreachable (network is reached but host not responding), Code 2 = Protocol Unreachable (the specified upper-layer protocol is not active on the destination), Code 3 = Port Unreachable (the destination port has no application listening).

Time Exceeded (Type 11): Every IP packet has a Time-to-Live (TTL) field. Each router that forwards the packet decrements the TTL by 1. When TTL reaches 0, the router discards the packet and sends an ICMP Type 11 Time Exceeded message back to the source. This behavior is the mechanism that makes traceroute work.

Redirect (Type 5): When a router receives a packet that it forwards out the same interface it arrived on, it knows the sender has a suboptimal route. The router forwards the packet but also sends an ICMP Redirect to the sending host, telling it to use a better next-hop for future packets to that destination.

ICMPv6 Messages

ICMPv6 is defined in RFC 4443 and provides all the error and informational messaging of ICMPv4, but also incorporates the Neighbor Discovery Protocol (NDP) — a critical set of functions that replace ARP and add additional IPv6-specific capabilities.

NDP uses four key ICMPv6 message types. Together, these messages handle router discovery, prefix advertisement for stateless address autoconfiguration (SLAAC), and neighbor (MAC) address resolution — all functions that required separate protocols in IPv4.

The NDP process for address resolution works as follows: When Host A needs to reach Host B by IPv6 address, it sends a multicast Neighbor Solicitation (NS) to the solicited-node multicast address derived from Host B's IPv6 address. Host B responds with a unicast Neighbor Advertisement (NA) containing its MAC address. Host A can then send frames directly to Host B.

For default gateway discovery, a host sends an RS when it comes online. Routers on the link reply with RAs containing the network prefix and the router's link-local address (used as the default gateway). This enables full SLAAC configuration without any manual input or DHCP.

Using Ping

Ping (Packet Internet Groper) is the most fundamental network diagnostic tool. It uses ICMP Echo Requests (Type 8) and Echo Replies (Type 0) to test whether a destination is reachable and to measure round-trip latency.

On Cisco IOS, the ping output uses single characters to represent each packet result: ! = Echo Reply received (success), . = Timeout — no reply received, U = ICMP Destination Unreachable received, N = Network Unreachable, P = Protocol Unreachable, Q = Source Quench, M = Could not fragment.

Router# ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

A structured ping troubleshooting methodology helps isolate where a connectivity problem exists:

Step 1 — Ping loopback (127.0.0.1): Tests whether the local IP stack is functioning. If this fails, the device's TCP/IP configuration is broken — no network testing is possible until this is fixed.

Step 2 — Ping the default gateway: Tests whether the local host can reach its router on the same network. If this fails, the problem is local: wrong IP address, wrong subnet mask, cable issue, or switch problem.

Step 3 — Ping the remote host: Tests end-to-end connectivity across networks. If this fails but the gateway ping worked, the problem is somewhere in the routing path or on the remote end.

Extended ping (available in privileged EXEC mode) allows you to specify the source IP address, packet count, packet size, and timeout — useful for testing specific paths or simulating traffic from a particular interface.

Using Traceroute

Traceroute (or tracert on Windows) traces the exact path that packets take from source to destination. It reveals every router (hop) along the path along with the round-trip time to each one — invaluable for identifying exactly where a network problem is occurring.

Traceroute works by exploiting the IP TTL field. It sends a series of packets with progressively increasing TTL values. The first packet has TTL=1 — the first router decrements it to 0 and sends back an ICMP Time Exceeded (Type 11) message, revealing that router's IP address. The second packet has TTL=2, reaching the second router before timing out, and so on. This process continues until the destination is reached (which sends an ICMP Port Unreachable or Echo Reply) or the maximum hop count is reached.

Each hop typically shows three round-trip time measurements, which reveals not just the path but the consistency of latency to each hop.

Router# traceroute 8.8.8.8
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
  1 192.168.1.1   4 msec  2 msec  3 msec
  2 10.0.0.1     12 msec 11 msec 13 msec
  3 172.16.0.1   18 msec 19 msec 17 msec
  4 8.8.8.8      25 msec 24 msec 26 msec

A * (asterisk) in traceroute output means no ICMP Time Exceeded response was received for that hop within the timeout. This is commonly caused by firewalls that block ICMP, routers configured not to send ICMP Time Exceeded messages, or rate-limiting on ICMP responses. Importantly, an asterisk does NOT necessarily mean the path is broken — traffic may still be forwarded through that hop normally.

Troubleshooting with ICMP

ICMP tools form the first line of network troubleshooting. A structured methodology prevents you from chasing problems in the wrong place. Start at the local host, work outward to the gateway, and then trace the full path to the remote destination.

If ping succeeds but the application fails, the connectivity problem is not at Layer 3 — it is at Layer 4 (wrong TCP port, firewall rule blocking specific ports) or Layer 7 (application misconfiguration, DNS failure, server-side issue). ICMP confirms Layer 3 is working; further diagnosis must happen at higher layers.