Type: Type of ICMP
Code: Subtype of ICMP
Checksum:ofThe purpose of checksum is to detect corruption in transit.
Rest of Internet Header: Four-bytes field, contents vary based on the ICMP type and code.
Ping:
Echo Request and Reply – Types 8 and 0
We discuss the ICMP
Echo Request Type 8 and Echo Reply Type 0 because ICMP uses these
messages in tandem. Remote hosts use these two message types to test
connectivity. The user executes the Ping utility, initiating the
generation of ICMP echo requests with the expectation that the
destination host sends a corresponding echo reply. Upon successful
receipt of the replies to the echo requests, shows that remote host
is alive.
Destination
Unreachable – Type 3
ICMP Type 3 message
Destination Unreachable alerts a source host of delivery problems
encountered while trying to reach the destination. Note that a
destination host sends only code types 2 and 3; a router can send all
codes. Destination Unreachable uses several code values to further
describe the function of the ICMP message being sent. Each code type
describes a different delivery problem encountered, as shown here:
0 = Network
unreachable
This message
indicates that the router cannot find the destination network (does
not exist or has failed) or has no route to this network. In other
words, the router cannot deliver or forward an IP datagram to the
destination network. This could be the result of a network that is
beyond the maximum distance limitation for the routing protocol in
use and is therefore considered unreachable (too far). When a client
attempts to connect to a host on a network that is unreachable, a
gateway generates this message to alert the source host of the
problem. You can think of this message as the gateway saying to the
sending host, "The street you are trying to locate is not found
or is too far to reach."
1 = Host
unreachable
The host unreachable
message alerts the sending host that the destination host requested
cannot be found. This could happen because this host has been turned
off or does not exist. You can think of this message as the gateway
saying to the sending host, "I found the street you were looking
for, but the house you are trying to find is not there."
2 = Protocol
unreachable
Protocol unreachable indicates that the Transport layer protocol
(UDP or TCP) is not available. The destination host or an intervening
gateway might send this message. You can think of this message as
saying, "The transport layer protocol you are attempting to
communicate with is not active on this host."
3 = Port
unreachable
A port unreachable message indicates that the process or
application the source host is attempting to establish a connection
with is not active on the destination host. Typically this type of
message is sent when an application has not been started or has
failed on this host. The destination host or an intervening gateway
might send this message. You can think of this message as saying,
"The process or application you are attempting to communicate
with is not active on this host," or, "I found the street,
I found the house, the lights were on, but no one was home."
4 = Fragmentation
is needed , but don't fragment bit set
This message occurs when a router receives a datagram that
requires fragmentation, but the router has the DF (don't-fragment)
flag turned on. The sending host generally has the responsibility of
fragmentation. The receiver has the responsibility of reassembly.However, when a router cannot forward a datagram because it is too big, if allowed the router might fragment the datagram further before transmitting it to an attached segment. If the router has the DF bit set, this will not happen and the router will trash the datagram. It then generates a message to alert the sender of this action by sending a Type 3, Code 4 message. The fragmentation bit also can determine the maximum packet size or MTU that hosts can transmit end to end along the communication path.
5 = Source route
failed
The message occurs if a router encounters a next hop in the source
route that does not reside on a directly connected network.
6 = Destination
network unknown
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular network because it is
unknown.
7 = Destination
host unknown
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular host because it is unknown.
8 = Source Host
Isolated (obsolete)
9 = Destination
network administratively prohibited
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular network because it is not
allowed. Access to this network has been prohibited.
10 = Destination
host administratively prohibited
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular host because it is not
allowed. Access to this host has been prohibited.
11 = Network
unreachable for ToS
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular network because the ToS
requested is not available.
12 = Host
unreachable for ToS
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular host because the ToS
requested is not available.
13 =
Communication administratively prohibited by filtering
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular host because it is not
allowed. An administratively configured filter has prohibited access
to this process or application.
14 = Host
precedence violation
This message occurs when a router receives an IP datagram that it
cannot deliver or forward to a particular host because the precedence
level requested does not match, and is not accepted or is invalid.
This could be a source host attempting to access a high security host
without the necessary security clearance values.
15 = Precedence
cutoff in effect
This message rarely occurs. However, you will receive this message
when a packet is dropped by the cutoff function.
Source
Quench – Type 4
A receiving host generates this message when it cannot process
datagrams at the speed requested due to a lack of memory or internal
resources. This message serves as a simple flow control mechanism
that a receiving host can utilize to alert a sender to slow down its
transmission of data. When the source host receives this message, it
must pass this information on to the upper-layer process, such as
TCP, which then must control the flow of the application's
datastream. A router generates this message when, in the process of
forwarding datagrams, it has run low on buffers and cannot queue the
datagram for delivery.
Redirect –
Type 5
A router sends a redirect error to the sender of an IP datagram
when the sender should have sent the datagram to a different router
or directly to an end host (if the end host is local). The message
assists the sending host to direct a misdirected datagram to a
gateway or host. This alert does not guarantee proper delivery; the
sending host has to correct the problem if possible.Only gateways generate redirect messages to inform source hosts of misguided datagrams. Note that a gateway receiving a misdirected frame does not trash the offending datagram if it can forward it. The gateway forwards the frame, sends an alert message to the source, and hopes the source host will properly direct future frames to the designated host or gateway indicated in the message. ICMP redirect messages alert source hosts when a datagram has been misdirected and should be resent. Four redirect error codes can occur:
* 0 = Redirect for
Network
* 1 = Redirect for
Host
* 2 = Redirect for
Type-of-Service and Network
* 3 = Redirect for
Type-of-Service and Host
Router
Advertisement and Solicitation – Types 9 and 10
Rather than
initializing a routing table with static routes specified in
configuration files, you can use the router ICMP advertisement and
solicitation messages. After bootstrapping, a host can transmit a
broadcast or multicast a solicitation message to which a router or
routers responds with a router advertisement. This allows
communicating hosts to learn of available routes dynamically and
update their routing tables.
Time
Exceeded – Type 11
The time exceeded message occurs when a router receives a datagram
with a TTL (Time To Live) of 0 or 1. IP uses the TTL field to prevent
infinite routing loops. A router cannot forward a datagram that has a
TTL of 0 or 1. Instead, it trashes the datagram and sends a time
exceeded message. Two different time exceeded error codes can occur:
* 0 = Time-To-Live
Equals 0 During Transit
* 1 = Time-To-Live
Equals 0 During Reassembly
As previously mentioned in the IP section of this chapter, the TTL timer is measured in seconds and originally was used before the existence of routers to guarantee that a datagram did not live on the Internet forever. Each gateway processing a datagram reduces this value by at least one if it takes longer to process and forward the datagram. When this value expires, the gateway trashes the datagram and sends a message back to the sender notifying the host of the situation.
The traceroute utility also uses the TTL value to discover the path or route to a destination host or network. Upon execution of the traceroute command, the initial ICMP message is sent out with a TTL value of 1 set in the IP header. You can use the traceroute program to determine, or rather trace, the path to a destination. Traceroute accomplishes this by sending a sequence of datagrams with the TTL set to 1, 2, and so on.
Parameter
Problem – Type 12
The parameter problem message indicates that a host or gateway
received and could not interpret an invalid or misunderstood
parameter. A host or gateway also can send this message when no other
ICMP message covering the problem can be used to alert the sending
host. In this respect, it is a catchall message. In most cases
this message indicates some type of implementation error occurred,
perhaps because of vendor incompatibility issues. A host or gateway
will not send this message unless it trashes the datagram containing
the parameter problem.Two parameter problem error messages can occur:
* 0 = IP Header Bad
(catchall error0)
* A host or gateway
sends this error to indicate a general implementation error of an
unspecific nature.
* 1 = Required
Option Missing
* The host or
gateway expected a specific option, but the sender did not send it.
Timestamp
Request and Reply – Types 13 and 14
Timestamp request and reply messages work in tandem. You have the
option of using timestamps. When used, a timestamp request permits a
system to query another for the current time. It expects a
recommended value returned to be the number of milliseconds since
midnight, Coordinated Universal Time. This message provides
millisecond resolution, considered a beneficial feature when compared
to other means of obtaining time from another host who provides
resolution in seconds. The two systems compare the three timestamps
and use RTT to adjust the sender's or receiver's time if necessary.
Note that most systems set the transmit and receive time as the same
value.The process for time resolution goes as follows:
* The requestor
stamps the originate time and sends the query.
* The replying
system stamps the receive time when it receives the query.
* The replying
system stamps the transmit time when it sends the reply to the query.
Inforamtion
Request and Reply – Type 15 and 16
Although ICMP messages list information request and reply as a
potential ICMP message type, they actually do not occur; thus they
are obsolete. A host can request information such as to what network
it was attached.
Address
Mask Request and Reply – Type 17 and 18
Address mask request and reply messages work in tandem. Although
we rarely use this message today, its original design supported the
function of dynamically obtaining a subnet mask. Hosts can use the
ICMP address mask request to acquire subnet masks during bootstrap
from a remote host. However, problems can occur when using ICMP to
receive a mask if a host gives an incorrect mask from an external
source. If the external source does not give a response, the source
host must assume a classful mask (that the network is not subnetted).
Conclusion:
IP is the workhorse of the Network layer within the TCP/IP suite.
All protocols and applications utilize IP for logical Network layer
addressing and transmission of datagrams between internet hosts. IP
provides an unreliable, connectionless datagram delivery service and
uses ICMP to send messages when it encounters an error.End host and routers use ICMP as a control, messaging, and diagnostic tool. ICMP utilizes IP to deliver its messages and is considered an integral part of IP. ICMP messages notify a host of problems. Although ICMP does not offer a solution to these problems, it can provide enough information for a source host to solve some of the problems that might occur in the internetwork. The most popular ICMP message is the echo request and reply. Utilizing the Ping utility, these messages allow you to test connectivity between end hosts.