Icmp Overview - Learning Module

Loading content...

0/228

ICMP Types: Complete Message Type Reference

Mastering the ICMP Message Catalog

Every ICMP message is identified by a Type field (8 bits) that determines the message's purpose, and most types include a Code field (8 bits) that provides additional specificity. Together, Type and Code form a comprehensive vocabulary for network feedback.

The IANA (Internet Assigned Numbers Authority) maintains the official registry of ICMP types and codes. While we've covered the most important types in previous pages, this final page provides a complete reference—cataloging every ICMP type, explaining when you'll encounter each, and noting which remain active versus deprecated.

This reference serves multiple purposes:

Quick lookup during troubleshooting
Exam preparation for networking certifications
Security auditing to understand what ICMP traffic to expect or block
Protocol completeness to understand the full ICMP ecosystem

What You Will Learn

By the end of this page, you will have a complete understanding of all ICMP type values and their meanings, detailed code values for each type, the status of each type (active, deprecated, or obsolete), practical scenarios where each type appears, ICMPv6 equivalents and differences, and a structured reference for future troubleshooting.

ICMP Type and Code Structure

Before cataloging all types, let's review how Type and Code work together in the ICMP header.

The Type-Code Hierarchy

Type (8 bits): Identifies the general category of message (0-255 possible values)
Code (8 bits): Provides specific details within that category (0-255 possible values per type)

Not all 256 Type values are assigned—the IANA registry contains gaps for historical reasons and future allocation. Similarly, not all Code values are used for a given Type.

Reading Type/Code Notation

When we write "Type 3, Code 4" or "3/4", this means:

Type 3 = Destination Unreachable
Code 4 = Fragmentation Needed and DF Set

In packet captures, you'll see:

icmp_type=3, icmp_code=4
Destination unreachable (Fragmentation needed)

Converting Mermaid diagram...

Type Numbering Logic

The original ICMP type assignment followed a loose pattern:

Types 0-8: Core functionality (Echo Reply/Request, Unreachable)
Types 9-18: Extended features (Router Discovery, Timestamps, Masks)
Types 30-40: Experimental and specialized (Traceroute, Mobile IP)

However, this pattern has exceptions and gaps. Some types were allocated, deprecated, and never really used. Modern networks primarily see Types 0, 3, 5, 8, and 11.

IANA Registry

The authoritative source is: IANA ICMP Parameters

This registry is updated when new types are defined or existing types are deprecated. Always check IANA for the most current information.

Memory Tip for Common Types

The most commonly seen types: 0 (Echo Reply), 3 (Unreachable), 5 (Redirect), 8 (Echo Request), 11 (Time Exceeded). For exams, remember: '0 and 8 for ping (Request=8, Reply=0)', '3 for problems', '11 for traceroute'. These five types represent 95%+ of ICMP traffic you'll see.

Complete ICMP Type Reference

The following table provides a complete reference to all allocated ICMP types. Status indicates current usage:

Active: Commonly used in modern networks
Rare: Valid but seldom seen
Deprecated: Officially discouraged
Obsolete: Should never be used

Complete ICMP Type Reference (ICMPv4)
Type	Name	Category	Status	RFC
0	Echo Reply	Query	Active	792
1	Unassigned	—	Reserved	—
2	Unassigned	—	Reserved	—
3	Destination Unreachable	Error	Active	792
4	Source Quench	Error	Deprecated	792, 6633
5	Redirect	Error	Active (security risk)	792
6	Alternate Host Address	—	Deprecated	—
7	Unassigned	—	Reserved	—
8	Echo Request	Query	Active	792
9	Router Advertisement	Query	Rare	1256
10	Router Solicitation	Query	Rare	1256
11	Time Exceeded	Error	Active	792
12	Parameter Problem	Error	Active	792
13	Timestamp Request	Query	Deprecated	792
14	Timestamp Reply	Query	Deprecated	792
15	Information Request	Query	Obsolete	792
16	Information Reply	Query	Obsolete	792
17	Address Mask Request	Query	Obsolete	950
18	Address Mask Reply	Query	Obsolete	950
19-29	Reserved	—	Reserved	—
30	Traceroute (Deprecated)	—	Deprecated	1393
31	Datagram Conversion Error	—	Deprecated	1475
32	Mobile Host Redirect	—	Deprecated	—
33	IPv6 Where-Are-You	—	Deprecated	—
34	IPv6 I-Am-Here	—	Deprecated	—
35	Mobile Registration Request	—	Deprecated	—
36	Mobile Registration Reply	—	Deprecated	—
37	Domain Name Request	—	Deprecated	1788
38	Domain Name Reply	—	Deprecated	1788
39	SKIP (Simple Key Management)	—	Deprecated	—
40	Photuris (Security Failures)	—	Rare	2521
41	ICMP for Experimental Mobility	—	Experimental	4065
42	Extended Echo Request	Query	Active (RFC 8335)	8335
43	Extended Echo Reply	Query	Active (RFC 8335)	8335
44-252	Unassigned	—	Reserved	—
253-254	Experimental	—	Experimental	3692
255	Reserved	—	Reserved	—

Extended Echo (Types 42-43)

RFC 8335 (2018) introduced Extended Echo Request/Reply for probing by name or interface identifier rather than IP address. This is a modern addition primarily used in MPLS/segment routing environments. Support is limited to newer implementations.

Type 3: Destination Unreachable Codes

Type 3 (Destination Unreachable) is the most complex ICMP type, with 16 defined codes covering different failure scenarios. Understanding these codes is essential for network troubleshooting.

Type 3 (Destination Unreachable) Complete Code Reference
Code	Name	Generator	Meaning
0	Network Unreachable	Router	No route to destination network exists
1	Host Unreachable	Router/Gateway	Network reachable but specific host unreachable
2	Protocol Unreachable	Host	Destination host doesn't support the protocol
3	Port Unreachable	Host	UDP port has no listening application
4	Fragmentation Needed (DF set)	Router	Critical for PMTUD — packet too large, DF set
5	Source Route Failed	Router	Strict/loose source route cannot be followed
6	Destination Network Unknown	Router	Network doesn't exist (admin error, not routing)
7	Destination Host Unknown	Router	Host doesn't exist (admin error)
8	Source Host Isolated	Router	Obsolete—never implemented
9	Network Administratively Prohibited	Router/FW	Firewall/ACL blocks to entire network
10	Host Administratively Prohibited	Router/FW	Firewall/ACL blocks to specific host
11	Network Unreachable for ToS	Router	Network unreachable for requested ToS
12	Host Unreachable for ToS	Router	Host unreachable for requested ToS
13	Communication Administratively Prohibited	Router/FW	Generic administrative block (RFC 1812)
14	Host Precedence Violation	Router	Precedence not permitted for src/dst pair
15	Precedence Cutoff in Effect	Router	Precedence below operator's cutoff

Practical Interpretation

Codes 0-1 (Network/Host Unreachable): Routing problems—check routing tables, BGP sessions, physical connectivity.

Code 2 (Protocol Unreachable): Rare—indicates destination doesn't support the IP protocol number in the packet.

Code 3 (Port Unreachable): Common with UDP—application not running or wrong port. Also used by traceroute to detect arrival.

Code 4 (Fragmentation Needed): PMTUD signal—includes MTU of limiting link. If you see this, adjust packet size.

Codes 9-13 (Administratively Prohibited): Firewall or ACL is blocking traffic. Check security policies.

Codes 6-8, 14-15: Rarely seen in modern networks; often indicate legacy or misconfigured equipment.

Code 4 Must Not Be Filtered

Filtering Type 3 Code 4 (Fragmentation Needed) breaks Path MTU Discovery. This causes TCP connections to hang when sending data larger than path MTU. This is extremely common in networks with VPNs, tunnels, or non-standard MTUs. Always allow Type 3 Code 4 through firewalls.

Other Error Types and Their Codes

Beyond Destination Unreachable, several other ICMP error types have multiple codes. Let's examine each.

Type 5 (Redirect) Codes
Code	Name	Meaning
0	Redirect for Network	Use different gateway for entire destination network
1	Redirect for Host	Use different gateway for this specific host only
2	Redirect for ToS and Network	Use different gateway for network + specific ToS
3	Redirect for ToS and Host	Use different gateway for host + specific ToS

Redirect Security Note: ICMP Redirects are a security risk—attackers can use them to hijack traffic. Modern best practice is to disable redirect processing on hosts and not generate them on routers.

Type 11 (Time Exceeded) Codes
Code	Name	Generator	Meaning
0	TTL Exceeded in Transit	Router	TTL decremented to 0 during forwarding
1	Fragment Reassembly Time Exceeded	Host	Not all fragments arrived within timeout

Time Exceeded Notes:

Code 0 powers traceroute—each router on the path sends this when TTL expires
Code 1 indicates fragment loss—usually means network instability or MTU issues

Type 12 (Parameter Problem) Codes
Code	Name	Meaning
0	Pointer Indicates Error	Error at byte position indicated by Pointer field
1	Missing Required Option	A required IP option is not present
2	Bad Length	An IP option has invalid length field

Parameter Problem Notes:

The message includes a Pointer field indicating the problematic byte offset
Usually indicates malformed packets or interoperability issues
Rare in well-functioning networks

Quick Error Identification

When troubleshooting: Type 3 = destination/path problem, Type 5 = router suggesting different path, Type 11 = TTL/fragment timeout, Type 12 = malformed packet. The Code then gives the specific cause. This Type→Code analysis quickly identifies where to focus investigation.

Query Message Types and Codes

Query messages are simpler—most use Code 0 for both request and reply. The complexity comes from matching requests to replies via Identifier and Sequence Number fields.

Query Message Types
Type	Name	Code	Status	Matching Reply
0	Echo Reply	0	Active	Response to Type 8
8	Echo Request	0	Active	Expects Type 0
9	Router Advertisement	0/16	Rare	Unsolicited or response to Type 10
10	Router Solicitation	0	Rare	Expects Type 9
13	Timestamp Request	0	Deprecated	Expects Type 14
14	Timestamp Reply	0	Deprecated	Response to Type 13
15	Information Request	0	Obsolete	Expects Type 16
16	Information Reply	0	Obsolete	Response to Type 15
17	Address Mask Request	0	Obsolete	Expects Type 18
18	Address Mask Reply	0	Obsolete	Response to Type 17
42	Extended Echo Request	0-4	Active	Expects Type 43
43	Extended Echo Reply	0-4	Active	Response to Type 42

Extended Echo (RFC 8335) Codes

The newer Extended Echo messages (Types 42/43) support several codes:

Extended Echo Reply (Type 43) Codes
Code	Name	Meaning
0	No Error	Probe succeeded, interface active
1	Malformed Query	Request was improperly formatted
2	No Such Interface	Requested interface doesn't exist
3	No Such Table Entry	No matching L2/L3 entry found
4	Multiple Interfaces Satisfy Query	Ambiguous query—multiple matches

Router Advertisement Code 16

Router Advertisement (Type 9) can use Code 0 for normal advertisements or Code 16 when the message doesn't include router addresses (RFC 3344). This is used in Mobile IP scenarios. Most traditional IRDP uses Code 0.

ICMPv6: The IPv6 Equivalent

ICMPv6 (RFC 4443) is the IPv6 version of ICMP. While it serves the same fundamental purposes, ICMPv6 has significant differences and expanded responsibilities.

ICMPv4 vs ICMPv6 Type Mapping
Function	ICMPv4 Type	ICMPv6 Type	Notes
Echo Request	8	128	Same function, different number
Echo Reply	0	129	Same function, different number
Destination Unreachable	3	1	Codes differ slightly
Packet Too Big	3/4 (code)	2	Separate type in ICMPv6
Time Exceeded	11	3	Same function
Parameter Problem	12	4	Extended in ICMPv6
Router Solicitation	10 (IRDP)	133	Essential for IPv6 (NDP)
Router Advertisement	9 (IRDP)	134	Essential for IPv6 (NDP)
Neighbor Solicitation	N/A (ARP)	135	Replaces ARP in IPv6
Neighbor Advertisement	N/A (ARP)	136	Replaces ARP in IPv6
Redirect	5	137	Same function

Critical ICMPv6 Differences

1. ICMPv6 is Mandatory Unlike ICMPv4, which is technically optional (though practically essential), ICMPv6 is required for IPv6 operation:

Neighbor Discovery Protocol (NDP) uses ICMPv6 exclusively
Stateless Address Autoconfiguration (SLAAC) depends on ICMPv6 Router Advertisements
Duplicate Address Detection (DAD) uses ICMPv6 Neighbor Solicitation

2. No ARP in IPv6 IPv6 eliminates ARP entirely. Address resolution is handled by ICMPv6 Neighbor Solicitation/Advertisement (Types 135/136). This is why ICMPv6 cannot be blocked in IPv6 networks.

3. Packet Too Big is a Separate Type In ICMPv4, "Fragmentation Needed" is Type 3 Code 4. In ICMPv6, it's a dedicated Type 2 (Packet Too Big). This separates PMTUD signaling from general unreachable errors.

4. Multicast Listener Discovery (MLD) ICMPv6 includes Types 130-132 for MLD, which replaces IGMP's role in IPv4 multicast.

Never Block Essential ICMPv6

Unlike IPv4, blocking ICMPv6 breaks fundamental IPv6 functionality. At minimum, allow: Type 1 (Dest Unreachable), Type 2 (Packet Too Big), Type 3 (Time Exceeded), Type 4 (Parameter Problem), Types 128-129 (Echo), Types 133-137 (NDP). Blocking NDP (133-137) completely breaks IPv6 communication.

Practical Quick Reference

For daily troubleshooting, this condensed reference covers what you'll see 99% of the time.

ICMP Quick Reference for Troubleshooting
Scenario	ICMP Type/Code	What It Means	Action
Ping succeeds	Type 0	Host reachable	Network path working
Ping timeout	No response	Host unreachable or filtered	Check routing, firewall, host status
Network unreachable	Type 3/0	No route exists	Check routing tables, BGP
Host unreachable	Type 3/1	Can't reach specific host	Check host status, last-hop router ARP
Port unreachable	Type 3/3	UDP port closed	Check application, correct port
Need to fragment	Type 3/4	Path MTU issue	Reduce packet size, check tunnels
Admin prohibited	Type 3/9,10,13	Firewall blocking	Check security policies
TTL exceeded	Type 11/0	Packet timed out	Check for loops, increase TTL
Redirect received	Type 5	Better route available	Usually benign, verify security

icmp-troubleshooting-commands.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# Essential ICMP troubleshooting commands
 
# Basic connectivity test
ping -c 4 target.example.com
 
# Discover path (uses Type 11/0 responses)
traceroute target.example.com      # Unix/Linux
tracert target.example.com         # Windows
 
# Test specific packet size for MTU issues
ping -c 1 -s 1472 -M do target.example.com   # Linux
ping -n 1 -l 1472 -f target.example.com      # Windows
 
# Monitor ICMP traffic on interface
sudo tcpdump -i eth0 icmp -n
 
# Filter specific ICMP types
sudo tcpdump -i eth0 'icmp[icmptype] == 3' -v   # Unreachable only
sudo tcpdump -i eth0 'icmp[icmptype] == 11' -v  # Time Exceeded only
 
# Watch for PMTUD messages
sudo tcpdump -i eth0 'icmp[icmptype] == 3 and icmp[icmpcode] == 4' -v
 
# Wireshark filter for ICMP errors
# Display filter: icmp.type == 3 || icmp.type == 11 || icmp.type == 12

Troubleshooting Workflow

Start with ping (Types 8/0). If it fails, run traceroute (uses Type 11). If traceroute shows the path, check for Type 3 errors. The combination of ping + traceroute + packet capture covers most network troubleshooting scenarios.

Summary: ICMP Types and Module Conclusion

We've now completed our comprehensive exploration of ICMP. This final page provided the complete type/code reference that ties together everything we learned:

Key Takeaways: ICMP Types

•Type identifies category, Code provides specifics — Together they precisely identify the message purpose and situation.
•Five types dominate real-world traffic — Types 0, 3, 5, 8, and 11 represent the vast majority of ICMP you'll see.
•Type 3 has the most codes (16) — Understanding Destination Unreachable codes is essential for troubleshooting.
•Many types are deprecated/obsolete — Source Quench (4), Timestamp (13-14), Address Mask (17-18), Information (15-16) should be ignored.
•ICMPv6 is similar but not identical — Different type numbers, and mandatory for IPv6 operation (NDP replaces ARP).
•Extended Echo (42-43) is newest addition — RFC 8335 provides enhanced probing for modern networks.

Module 1 Complete: ICMP Overview

Across five pages, we've built comprehensive knowledge of ICMP:

ICMP Purpose — Why IP needs a feedback mechanism
Error Reporting — How ICMP reports delivery problems
Query Messages — How ICMP enables active diagnostics (ping)
ICMP Encapsulation — How ICMP travels within IP packets
ICMP Types — Complete reference to all message types

You now possess the knowledge to:

Interpret any ICMP message you encounter
Use ping and traceroute with full understanding of underlying mechanisms
Configure firewall rules that protect while maintaining essential functionality
Troubleshoot network issues using ICMP feedback
Explain ICMP's role in the TCP/IP protocol suite

Next Module: ICMP Message Types

The next module will dive deeper into specific ICMP message types with detailed examples, packet captures, and real-world troubleshooting scenarios.

Module Complete: ICMP Overview

Congratulations! You've mastered the Internet Control Message Protocol. You understand why ICMP exists, how it works at the packet level, and how to use it for network diagnostics. This knowledge is foundational for network engineering, security analysis, and troubleshooting at any scale.