What is ICMP and why does IP need it?
ICMP carries control and error information related to IP delivery. It is not a transport protocol like TCP or UDP and it does not carry ordinary application conversations. Instead, hosts and routers use it to report conditions such as an unreachable destination, an expired hop limit, or information needed for path MTU handling.
ICMP is therefore part of normal IP operation, not merely the protocol behind ping. Blocking every ICMP message can remove useful diagnostics and break mechanisms that depend on specific message types.
Echo Request and Echo Reply: what does ping really prove?
ping typically sends ICMP Echo Request messages and waits for Echo Replies. A successful reply proves that an IP path exists in both directions for those messages and that the destination responds to Echo. It does not prove that DNS, TCP, a web server, or another application is working.
A failed ping is equally ambiguous. The destination may be down, routing may be broken, a firewall may filter Echo, or the return path may differ. Use ping as one signal, not as a complete health check.
Destination Unreachable and useful error messages
ICMP Destination Unreachable messages communicate that a packet could not be delivered for a specific reason. Depending on IP version and context, the reason may involve a network, host, protocol, port, filtering policy, or packet-size problem.
These errors are valuable because silence alone does not explain failure. A packet capture that shows an unreachable message can immediately distinguish routing or service problems from simple timeout behavior.
Time Exceeded, TTL/Hop Limit, and traceroute
IPv4 packets carry a TTL field and IPv6 packets carry a Hop Limit. Routers decrement it as the packet moves between hops. When the value reaches zero, a router discards the packet and can send an ICMP Time Exceeded message.
Traceroute-style tools deliberately send probes with progressively larger TTL/Hop Limit values. The resulting Time Exceeded responses reveal intermediate routers. Different traceroute implementations may use UDP, ICMP, or TCP probes, so results can vary when filtering is present.
ICMP and Path MTU Discovery
A path may include links with different MTUs. Path MTU Discovery helps endpoints choose packet sizes that can cross the entire path. In IPv4, ICMP feedback can indicate that fragmentation is needed but prohibited. In IPv6, Packet Too Big messages are especially important because routers do not fragment transit packets.
If the relevant ICMP messages are blocked, small packets may work while larger transfers stall. This is a classic reason to avoid blanket "block all ICMP" rules.
ICMPv6 is even more important in IPv6
ICMPv6 includes error reporting and diagnostic messages, but it also carries Neighbor Discovery functions. Neighbor Solicitation, Neighbor Advertisement, Router Solicitation, and Router Advertisement are fundamental to normal IPv6 operation.
IPv6 does not use ARP. Neighbor Discovery and related ICMPv6 behavior fill that role and provide additional functions. Security policy must therefore permit the ICMPv6 types required for the local design.
ICMP Redirect: what it means and why it is not a design foundation
A router can send an ICMP Redirect to tell a host that a better next hop exists on the same local network. While the mechanism is part of IP, modern managed networks generally prefer correct routing and gateway design rather than relying on redirects to compensate for topology mistakes.
Many environments restrict or disable redirects for security and predictability reasons. Seeing them unexpectedly can be a clue that hosts and routers disagree about the intended path.
Security: do not block everything, do not trust everything
ICMP can be abused for reconnaissance, flooding, or covert behavior, so controls are justified. The right approach is selective policy: allow the message types needed for normal operation and diagnostics, rate-limit where appropriate, and log suspicious patterns.
Security should distinguish an Echo Request from critical error messages or IPv6 Neighbor Discovery. Treating every ICMP type as equivalent creates brittle networks.
How to recognize ICMP in a packet capture
In Wireshark, filters such as icmp and icmpv6 isolate control messages. Inspect the type, code, source and destination addresses, and the packet quoted inside an error message. That quoted header often tells you exactly which original flow triggered the error.
For traceroute, watch TTL/Hop Limit values and Time Exceeded responses. For MTU issues, look for fragmentation-related IPv4 messages or IPv6 Packet Too Big messages.
A practical ICMP diagnostic method
- Verify local addressing and the default gateway.
- Ping the local gateway to test the first routed hop.
- Test a remote IP address separately from DNS.
- Use traceroute when you need to see where the path stops.
- Compare small and large probes if MTU problems are suspected.
- Capture traffic when the command-line result is ambiguous.
- Then move to transport and application checks.
ICMP is most useful when combined with routing knowledge, TCP/UDP, and packet analysis.