ICMP
Echo messages (8 and 0), destination unreachable (3 and its codes), time exceeded (11) and redirect (5), how ping and traceroute use them, and path MTU discovery.
- 32 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- The steps
- Scenarios
A few cards from the deck
ICMP protocol: what is it?
Show the answer
A protocol that routers and hosts use to report errors and ask simple questions about the network, carried directly in an IP packet.
IP has no way of saying it dropped a packet; ICMP fills that gap. An ICMP message has a type and a code, but no port: the IP header's protocol field is 1.
How does traceroute discover the address of the path's second router?
- Its TTL 2 probe dies at the 2nd router, which sends back a type 11
- It queries the routing table of the path's first router
- It sends a TTL 1 probe and reads the first router's address
- It sends an echo and reads the route field of the reply received
Show the answer
Its TTL 2 probe dies at the 2nd router, which sends back a type 11
With a TTL of 2, the probe passes the first router (TTL 1) and dies at the second, which sends a type 11 message carrying its own address. TTL 1 only reveals the first router.
ICMP travels in an IP packet whose protocol field is …, and it has no ….
Show the answer
ICMP travels in an IP packet whose protocol field is 1, and it has no port.
ICMP sits at IP's level: it talks to the machine, not to an application. That is why “opening the ICMP port” makes no sense: you filter by type and code.
Type 11 message: what is it?
Show the answer
The message a router sends back to the sender when it destroys a packet whose TTL reaches zero.
Its name is “time exceeded” (code 0 for the TTL). It carries the address of the router sending it: this is how traceroute learns the name of each hop.