Imagine you're driving to a destination and your GPS routes you through a particular intersection. A traffic officer stops you and says: "Next time you want to go that direction, take the left turn right here instead of driving all the way to me first. It's a shorter path." The officer lets you continue your current route but has just taught you a better route for future trips.

This is exactly how ICMP Redirect (Type 5) works in IP networks. A router that forwards a packet sends a Redirect message back to the source saying: "You sent this packet to me, but there's a better gateway on your same network. Next time, send directly there."

Redirect messages enable dynamic route optimization without requiring hosts to run routing protocols. However, they also represent one of the most significant security vulnerabilities in ICMP, leading to their widespread deprecation in modern networks.

ICMP Redirect addresses a specific inefficiency in networks with multiple gateways. Consider a LAN with two routers:

• Router A (192.168.1.1): Default gateway, routes to the Internet
• Router B (192.168.1.2): Routes to remote corporate offices via WAN link
• Host (192.168.1.100): Configured with only Router A as default gateway

When the host wants to reach a corporate office (10.20.30.0/24), it sends the packet to Router A (its only known gateway). Router A knows that Router B is the correct gateway for that destination, forwards the packet to Router B, then sends an ICMP Redirect to the host.

The Efficiency Gain:

Without Redirect, the inefficient path persists:

Host → Router A → Router B → Destination (every packet)

With Redirect, after the first packet:

Host → Router B → Destination (direct optimal path)

When Redirect is Generated:

A router generates a Redirect message when ALL of the following conditions are met:

1. The packet arrives on the same interface as the optimal outgoing interface
2. The source IP address is on the same network as the next-hop gateway
3. The packet is not source-routed
4. The redirect's gateway is directly reachable from the source host
5. The router is configured to send redirects (not always true today)

The ICMP Redirect message has a unique format among ICMP messages—it includes a Gateway Address field specifying the recommended next-hop router.

Code Selection Logic:

Code 0 (Network Redirect): Generated when the router determines that an entire network is better served by the alternative gateway. The host should update its routing table to send all traffic for that network prefix via the new gateway.

Code 1 (Host Redirect): Generated when only traffic to this specific destination host should use the alternative gateway. Other hosts on the same network may still use the original router.

Codes 2-3 (TOS Redirects): These refine the redirect based on Type of Service/DSCP values. A host might use different gateways for different traffic classes. These are rarely implemented in practice.

In modern networks, Code 1 (Host Redirect) is most commonly seen, as router implementations tend to be conservative about making network-wide routing suggestions.

When a host receives an ICMP Redirect, it must decide whether to trust and act on the message. This decision has significant security implications.

Operating System Redirect Behavior:

Note: Modern Linux kernels (4.x and later) disable redirect acceptance by default as a security measure. This is controlled by net.ipv4.conf.*.accept_redirects.

The Attack Scenario:

1. Attacker is on the same LAN as the victim
2. Victim trusts ICMP Redirects (default on older/misconfigured systems)
3. Attacker sends forged ICMP Redirect to victim:
   • Source IP: Spoofed as victim's default gateway
   • Gateway IP: Attacker's own IP address
   • Destination: The target the attacker wants to intercept
4. Victim updates routing cache to send traffic through attacker
5. Attacker receives victim's traffic, can inspect/modify, then forwards to real destination
6. Neither victim nor destination knows traffic is being intercepted

Why This Attack Works:

1. No Authentication: ICMP has no authentication mechanism. Any packet with correct structure is processed.
2. Source Spoofing: Attacker forges source IP to appear as the legitimate gateway.
3. Local Network Access: The same-subnet requirement means attacker is already on the LAN, where spoofing is easiest.
4. Default Trust: Older/misconfigured systems accept redirects by default without strong validation.

Given the security risks, modern networks implement multiple layers of defense against ICMP Redirect attacks.

ICMP Redirect was designed for an era when hosts had minimal routing intelligence and networks had simple topologies. Modern networks have largely moved beyond the scenarios where Redirect provided value.

IPv6 also supports Redirect messages, but with somewhat different semantics integrated with Neighbor Discovery Protocol (NDP) rather than standalone ICMP.

ICMPv6 Redirect (Type 137) Improvements:

1. Source Address Validation: ICMPv6 Redirect must come from the link-local address of the current first-hop router. Link-local addresses (fe80::/10) are not routable, making remote spoofing impossible.

2. Target and Destination Fields: ICMPv6 Redirect includes both the target (new next-hop) and the destination being redirected. The target can be the destination itself (for on-link destinations) or another router.

3. Optional Link-Layer Address: The redirect can include the target's link-layer address, allowing immediate communication without an additional neighbor solicitation.

4. SEND Compatibility: Secure Neighbor Discovery (SEND, RFC 3971) can cryptographically sign NDP messages including Redirects, providing authentication. However, SEND deployment is rare.

While recommending redirect disabling, network engineers must understand scenarios where redirects might appear and how to troubleshoot related issues.

ICMP Redirect represents a fascinating case study in protocol evolution—a feature that solved real problems in early networks but became a significant security liability as networks evolved and threat models matured.