What Is ICMP? Ping, Traceroute, and Network Diagnostics

ICMP is the protocol behind ping and traceroute. Learn how these diagnostic tools work, what ICMP message types mean, and how attackers abuse ICMP in DDoS and reconnaissance.

What Is ICMP?

ICMP (Internet Control Message protocol) is a Layer 3 protocol used by network devices to send error messages and operational information. Unlike TCP-the-internets-core-protocol) and UDP, ICMP is not used to carry application data — its purpose is network diagnostics and control.

ICMP is defined in RFC 792 and is a core part of the [IP protocol](/learning-center/what-is-TCP-ip-the-internets-core-protocol) suite. Every network administrator and security professional needs to understand it.

ICMP Message Types

ICMP messages have a type and code field that identify what the message means:

| Type | Name | What it means | |---|---|---| | 0 | Echo Reply | Response to a ping | | 3 | Destination Unreachable | packet-the-internets-core-protocol)-ip-the-internets-core-protocol) could not be delivered | | 5 | Redirect | Better route available | | 8 | Echo Request | Ping | | 11 | Time Exceeded | TTL reached zero (used by traceroute) | | 12 | Parameter Problem | Malformed IP header |

Type 3 (Destination Unreachable) has sub-codes including network unreachable, host unreachable, and port-the-internets-core-protocol)-and-UDP-ports-explained) unreachable (used when UDP reaches a closed port).

Ping: Testing Reachability

Ping is the simplest network diagnostic tool. It sends an ICMP Echo Request to a target and waits for an Echo Reply, measuring the round-trip time (RTT).

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=12.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=118 time=11.8 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=118 time=12.1 ms

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss
rtt min/avg/max/mdev = 11.8/12.0/12.3/0.2 ms

Key values to interpret:

  • time: Round-trip time in milliseconds. High values indicate latency.
  • ttl: Time To Live at the destination. Helps estimate how many hops away the target is.
  • packet-the-internets-core-protocol)-ip-the-internets-core-protocol) loss: Any loss suggests network issues between you and the target.

What Ping Tells You

| Result | Interpretation | |---|---| | Fast replies | Network path is healthy, low latency | | High RTT | Congestion or long physical distance | | packet-the-internets-core-protocol)-ip-the-internets-core-protocol) loss | Congestion, instability, or firewall dropping packets | | Request timed out | Host unreachable, firewall blocking ICMP, or host offline |

> Note: A host that does not respond to ping is not necessarily offline — many firewalls block ICMP Echo Requests.

TTL: Time To Live

Every IP packet-ip-the-internets-core-protocol) includes a TTL field — an integer that is decremented by 1 at each router-network-address-translation-explained) hop. When TTL reaches 0, the router drops the packet and sends an ICMP "Time Exceeded" message back to the sender. TTL prevents packets from looping forever in a [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) loop.

Starting TTL values by operating system:

  • Windows: 128
  • Linux / macOS: 64
  • Cisco routers: 255

By observing the TTL in a ping response, you can estimate how many hops the target is from you: approximate hops = default TTL minus received TTL.

Traceroute: Mapping the Path

Traceroute (Linux / macOS) or tracert (Windows) maps every hop between you and a destination by exploiting TTL:

  1. Send a packet-the-internets-core-protocol)-ip-the-internets-core-protocol) with TTL=1 — first router-network-address-translation-explained) decrements to 0 — router sends Time Exceeded — record the router IP
  2. Send a packet-the-internets-core-protocol)-ip-the-internets-core-protocol) with TTL=2 — second router-network-address-translation-explained) sends Time Exceeded — record it
  3. Continue until you reach the destination
$ traceroute 8.8.8.8
traceroute to 8.8.8.8, 30 hops max
 1  192.168.1.1     0.5 ms   (your home router)
 2  10.0.0.1        5.1 ms   (ISP gateway)
 3  85.31.0.1       8.2 ms   (ISP core router)
 4  * * *                    (router blocking ICMP)
 5  209.85.252.1   11.0 ms   (Google edge)
 6  8.8.8.8        12.1 ms   (destination)

Star symbols (***) mean a router-network-address-translation-explained) did not respond — it may be blocking ICMP, but the path continues beyond it.

Traceroute uses:

  • Identifying where latency spikes occur (which hop introduces delay)
  • Discovering [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) paths and peering relationships
  • Diagnosing asymmetric [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3)

ICMP in Security: Attack Techniques

Ping Sweep

Attackers send pings to every IP in a range to discover which hosts are alive — a common first step in reconnaissance. Firewalls and IDS-intrusion-detection-and-prevention-explained)/IPS systems detect and alert on ICMP sweeps.

# Using nmap for ping scan (no port scan)
nmap -sn 192.168.1.0/24

ICMP Flood (Ping Flood)

A volumetric DDoS attack that sends massive numbers of ICMP Echo Requests to overwhelm a target — consuming bandwidth and CPU resources until legitimate traffic is crowded out. Modern mitigation involves rate-limiting ICMP at network edges.

Ping of Death (Historical)

Historically, sending a malformed oversized ICMP packet-the-internets-core-protocol)-ip-the-internets-core-protocol) (larger than 65,535 bytes) could crash older operating systems. This was patched in the 1990s.

ICMP Redirect Attacks

An attacker sends forged ICMP Redirect messages to tell a victim to route traffic through the attacker machine. Many modern operating systems ignore ICMP redirects by default.

ICMP Tunnelling

ICMP Echo payloads can carry arbitrary data. Attackers have used ICMP tunnelling to exfiltrate data or maintain command-and-control channels through firewalls that allow ICMP but block other outbound traffic.

Path MTU Discovery

ICMP Type 3, Code 4 ("Fragmentation Needed") is used in Path MTU Discovery (PMTUD) — the process by which a sender discovers the largest packet-the-internets-core-protocol)-ip-the-internets-core-protocol) size that can travel the path without fragmentation.

If a firewall blocks all ICMP, PMTUD breaks, causing "black hole" [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) where large packets are silently dropped and TCP-the-internets-core-protocol) connections appear to stall.

Blocking ICMP: Pros and Cons

| | Block ICMP | Allow ICMP | |---|---|---| | Privacy | Hosts harder to discover | Hosts discoverable by ping | | Diagnostics | Harder to troubleshoot | Easy to verify reachability | | Security | Prevents ping sweeps | reconnaissance possible | | Side effects | Breaks PMTUD, traceroute | Normal operation |

Best practice: Allow ICMP selectively — permit Echo Reply inbound, permit Destination Unreachable and Time Exceeded for PMTUD and traceroute, rate-limit Echo Requests, and block ICMP at the perimeter for public-facing infrastructure where stealth is desired.

Summary

  • ICMP is a control protocol for error reporting and network diagnostics, not application data
  • Ping uses ICMP Echo Request and Echo Reply to test reachability and measure round-trip time
  • Traceroute uses TTL manipulation to map every hop along a network path
  • TTL prevents [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) loops; observing received TTL gives an estimate of hop count
  • ICMP is exploited for ping sweeps, flood attacks, redirects, and covert tunnelling
  • Block ICMP selectively — a blanket block breaks PMTUD and makes diagnostics impossible