The ICMP protocol is part of the Internet Protocol (IP) suite, which stands for “Internet Control Message Protocol.” Unlike other protocols, such as Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), which are used to transfer data between different systems, the primary purpose of ICMP is to deliver messages about communication errors and provide network diagnostics.

Think of it this way. When you send a package, the courier service will send you a message if something goes wrong. That’s what the ICMP protocol does for the Internet. So, when you send a video to a contact and get an error message that says, “Couldn’t send,” that’s most likely the ICMP just doing its job.

Read More about the ICMP Protocol

The ICMP protocol is an important part of how the Internet works, but most people haven’t heard about it. After all, it’s not moving data for us. It’s merely used to inform us about the data we’re sending. Learn more about ICMP below.

How Does ICMP Work?

ICMP works by piggybacking on another protocol, which is IP. An ICMP message is encapsulated within an IP packet. When a router or host encounters a problem with a data packet (say, it can’t find the destination or the packet is too big), it creates a new ICMP message and sends it back to the source. Here’s a step-by-step description of how ICMP works.

  1. A problem is found: A network device (e.g., a router) is trying to send a data packet but encounters an issue, which could be anything from a nonexistent destination address to a packet bouncing around for too long.
  1. A status report is created: The router immediately generates a small ICMP message explaining what went wrong. For example, it might say “Destination Unreachable” or “Time Exceeded.”
  1. The message gets a ride: The ICMP message is then placed inside a standard IP packet, which also includes some of the original packet’s information. This helps the sender figure out what the issue was.
  1. The report is sent back: The new IP packet carrying the ICMP message is sent to the original source or the computer that initially sent the data.
  1. The sender makes a decision: When the original sender receives the ICMP message, it now has the information it needs to take action. If it receives a “Destination Unreachable” message, for instance, it can stop trying to send the data to that address or try a different route.

What Is the ICMP Protocol Used For?

While you may never see an ICMP packet, you’ve almost certainly used a tool that relies on it. ICMP is crucial for network diagnostics, error reporting, and path maximum transmission unit (MTU) discovery. We’ll talk more about these use cases below.

What Is the ICMP Protocol Used For?

Network Diagnostics

The biggest role that the ICMP protocol plays is in network diagnostics, specifically in the ping command and the traceroute tool. The ping command is the most famous use of ICMP. When you ping an address, your computer sends an ICMP echo request, and the remote host sends back an ICMP echo reply. This tells you if the host is up and running and measures the round-trip time (latency) between you and the host.

ICMP also plays a part in how the traceroute network diagnostic tool works, specifically using “Time Exceeded” messages to map the path a packet takes to its destination by revealing each router or hop along the way. It sends packets with an intentionally low time to live (TTL), causing each router on the path to send back an ICMP message, effectively letting you see every hop.

Error Reporting

When a problem occurs, an ICMP message gives a specific reason. These ICMP error messages come in two sets, one for IPv4 and the other for IPv6, as shown in the table below.

Error MessageDescriptionCodes for IPv4Codes for IPv6
Destination UnreachableTells the sender that the packet couldn’t be delivered to its destination.0 – 150 – 8
RedirectGuides a host to a better, more efficient router on the network.0 – 3N/A
Time ExceededSent when a packet’s Time to Live (TTL) expires.0 – 10 – 1
Parameter ProblemIndicates a packet was dropped due to a malformed IP header.0 -20 – 10
Packet Too BigSent by a router when a packet with the Don’t Fragment (DF) bit set is too large for the next-hop link.N/A0

You can find more details about these and other error messages here.

Path MTU Discovery

Path MTU discovery is a method for finding the largest packet size or MTU, that can be sent along a specific network path without being broken up or fragmented. Fragmentation is inefficient because it requires extra processing by routers and the destination host. Path MTU discovery helps avoid this, and ICMP plays a crucial role in the process.

When a device sends a packet with the “Don’t Fragment” flag set, routers along the path are instructed not to break it up. If a router encounters a packet that’s too big for its next-hop link, it drops the packet and sends an ICMP “Packet Too Big” message back to the sender. This message includes the smaller MTU of that link. The sending device then reduces its packet size and resends the data, continuing this process until it finds the smallest possible packet size that can travel the entire path without fragmentation.

Does ICMP Present a Security Risk?

The short answer is yes. While ICMP is essential for network management, its simplicity and lack of built-in authentication make it easy to exploit. Attackers can use ICMP to perform reconnaissance on a network.

Because ICMP traffic is often allowed by default on many networks, it can serve as a back door for malicious activity, including denial-of-service (DoS) attacks.

What Attacks Are Commonly Associated with ICMP?

We’ll tackle four cyber attacks that take advantage of ICMP. They are:

  • Ping or ICMP flooding: This is a simple but effective DoS attack where an attacker overwhelms a target server with an immense number of ICMP echo request packets. The server’s resources are completely consumed by trying to respond to all the requests, leaving no capacity to handle legitimate traffic.
  • Ping of death: Although this is now obsolete, the ping of death is still worth discussing. An attacker would send a malformed, oversized ICMP packet that would cause a buffer overflow on older and unpatched systems, leading to a system crash or reboot. Most modern operating systems (OSs) are now protected against this.
  • Smurf attack: A smurf attack is a type of distributed DoS (DDoS) attack where the attacker sends a single ICMP echo request packet to a network’s broadcast address, but with a spoofed source IP address (i.e., that of the victim). All the devices on that network respond to the broadcast, sending ICMP echo replies back to the victim and flooding the target system with traffic.
  • ICMP tunneling: This is a sneaky way to bypass a firewall, and it involves attackers encapsulating other protocols like TCP or Secure Shell (SSH) inside an ICMP packet. If a firewall is configured to block TCP or SSH but not ICMP, the attacker can use the tunnel to exfiltrate data or control a compromised system, effectively hiding malicious traffic in plain sight.

What Are the Pros and Cons of ICMP?

Like any tool, ICMP has its good and bad sides. Let’s take a look at each of them.

Advantages of the ICMP Protocol

ICMP is a network administrator’s best friend, so to speak, because it enables ping and traceroute, which are crucial for troubleshooting connectivity and performance issues. You can’t manage what you can’t see, and ICMP provides that crucial visibility.

ICMP messages also handle the task of delivering error messages quickly without burdening the network, since they are small and simple.

Lastly, ICMP standardizes error reporting, providing a common language for network devices to report problems. This makes it easier to diagnose issues across different types of hardware and software.

Disadvantages of the ICMP Protocol

As we’ve covered, ICMP’s simplicity and lack of authentication make it a prime target for attackers to launch DoS attacks and conduct reconnaissance. Therefore, ICMP is very vulnerable to attacks.

Because of security risks, many network administrators choose to block all incoming ICMP traffic, even if it means crippling essential troubleshooting tools.

ICMP is also unreliable because there’s no guarantee that its messages are delivered. The ICMP message itself may get lost, so you can’t always rely on it for definitive error reporting. 

—

Blocking ICMP is a common security practice, but it’s important to do it with caution. The best way is to use a firewall to create specific rules, such as limiting the number of ICMP echo requests a device will respond to per second. Network administrators may also block incoming ICMP echo requests (the ping command) to prevent devices from being ping-flooded or used for reconnaissance.

Key Takeaways

  • The ICMP protocol is the Internet’s “error messenger,’ used for diagnostics and error reporting, not for moving your regular data.
  • It’s the engine behind network troubleshooting tools like ping and traceroute. It is also used for error reporting and path MTU discovery.
  • While essential for network diagnostics, ICMP can pose major security risks due to its lack of authentication, making it a target for DoS attacks and reconnaissance.
  • It is associated with attacks like ping flooding, the ping of death, smurf attacks, and ICMP tunneling.

Sources

  • https://www.ibm.com/docs/en/zos-basic-skills?topic=nll3-internet-control-message-protocol-icmp-other-layer-3-protocols
  • https://datatracker.ietf.org/doc/rfc4861/
  • https://community.cisco.com/t5/networking-knowledge-base/icmp-internet-control-message-protocol/ta-p/3116636