The Internet control message protocol has a wide variety of different message types many of which are extremely useful for managing and troubleshooting an IP Network. Most of us are familiar with the command ‘ping’ which uses at it’s core both ICMP echo and echo reply. Another well used ICMP tool is that of traceroute which is useful for monitoring TTLs (time to live) and hop counts.
There are however quite a number of these ICMP messages, beyond the ones used by these tools and most are extremely useful for anyone managing a complex IP based network. Here’s some of the most useful ones:
ICMP unreachable – an IP host will produce an ICMP unreachable message if there is no valid path to the requested host, network, protocol or port. There are several of these messages which are often grouped together for convenience. They are often generated from routers and switches, for example if local access lists are restricting access to the requested resource. You should be careful about allowing these messages to be propagated as they contain source addresses. Particularly if the connection is being used externally perhaps through an external connection like a BBC VPN for instance. The messages can be blocked by using the no ip unreachables command on Cisco hardware.
ICMP redirects – a router will produce a redirect message if it receives a packet on a given interface and the route is on the same device. These can be used to help update local routing tables with the correct information. There is an interesting protocol from Cisco which can be configured to help with these situations it’s called the Hot Standby Routing Protocol (HSRP).
ICMP mask request and reply – some hosts do not have their subnet masks statically defined and have no way of learning it. Here they can use an ICMP mask request which can be responded to by the router with an ICMP mask reply.
ICMP source quench – these messages provide an important function within ICMP that of congestion control on the network. If a network device such as a router detects network congestion perhaps because of dropped packets or overflows in buffers and on it’s interfaces then it will send an ICMP source quench message to the source of these packets.
ICMP Fragmentation – this type of message is sent when an IP packet is received which is larger than the MTU specified within the LAN or WAN environment yet it also has the flag DF set (do not fragment). Here the packet cannot be forwarded however the ICMP message can be used to at least pass back some information on the issue. There are actually quite a few scenarios where the DF bit is set automatically by devices as the packet is distributed.
John Summer, Proxy for Netflix – video, Harvard Press, 2017