Webspace Sponsored by:

Version 0.0.0 @ 03:55/08.07.2000

Decomposition of a ICMP Packet


Bits used per field:
0....... 8....... 16...... 24......
(<--------32-bits-wide-------->)
8BitType
8BitCode
16-bit-checksum-
--------data/payload(?)---------

The above is an example of an ICMP Header. ICMP is considered an unreliable protocol where no attempt is made to keep track of packets as to being in a sequence, order, or verify that they were received. (OVERSTRIKE BEGIN)Checks are made to see if the packet appears to be the same packet transmitted by evaluation of a checksum and comparison to the packets checksum. These packets are dropped if the destination calculations of the checksum differs from the packets claimed checksum.(OVERSTRIKE END) After being contacted by "Luzian Scherrer" <luzian@scherrer.ch>, I was asked if the above was true. Luzian asked, does a host need to drop an ICMP packet that has an invalid checksum? Luzian performed some tests to see if vendors provided support for droping ICMP packets with invalid checksum and found many vendors were inconsistent in their use of the ICMP checksum. At this time, I will alter the above text to read like this: Though there is no requirement in ICMP RFC (AFAIK) to drop ICMP packets that have invalid checksum, and there is no mention of this being a SHOULD for the protocol, the risk of not doing it is the remote host may choose to ignore an ICMP packet that has an invalid checksum. If you find information on where dropping is SUGGESTED or REQUIRED for the RFC on ICMP, please let me know.

ICMP is probably one of the more misunderstood of the common TCP/IP suite of protocols. The complexity of its conveyed content is minimal, but the actual meaning of the messages delivered and how it effects routes, sessions, and operations between hosts and nodes is more complicated. With exception to the math behind understanding all of the routing mechanisms in the various routing protocols that run over IP (RIP, OSPF, etc.) this is probably the one with the most complexity with all effects taken into consideration. (My opinion.)

Description of types and codes for ICMP:
Type
Code
RFC/Ref.
Q
E
H
G
Purpose and/or Description
---0 ---0 RFC-792-
+
-
+
+
for echo reply message (also see Type 8)
---1 ---X N/A JBP-
X
X
X
X
Unassigned (Also see RFC-1700)
---2 ---X N/A JBP-
X
X
X
X
Unassigned (Also see RFC-1700)
---3 ---0 RFC-792-
-
+
-
+
net unreachable
---3 ---1 RFC-792-
-
+
-
+
host unreachable
---3 ---2 RFC-792-
-
+
+
-
protocol unreachable
---3 ---3 RFC-792-
-
+
+
-
port unreachable
---3 ---4 RFC-792-
-
+
-
+
fragmentation needed and DF set
---3 ---5 RFC-792-
-
+
-
+
source route failed
---3 ---6 RFC-1122
-
+
?
?
destination network unknown
---3 ---7 RFC-1122
-
+
?
?
destination host unknown
---3 ---8 RFC-1122
-
+
?
?
source host isolated
---3 ---9 RFC-1122
-
+
?
?
communication with destination network administratively prohibited
---3 --10 RFC-1122
-
+
?
?
communication with destination host administratively prohibited
---3 --11 RFC-1122
-
+
?
?
network unreachable for type of service
---3 --12 RFC-1122
-
+
?
?
host unreachable for type of service
---3 --13 RFC-1812
-
+
?
?
Communication Administratively Prohibited
---3 --14 RFC-1812
-
+
?
?
Host Precedence Violation
---3 --15 RFC-1812
-
+
?
?
Precedence cutoff in efect
---4 ---0 RFC-792-
-
+
+
+
source quench message
---5 ---0 RFC-792-
-
+
-
+
Redirect datagrams for the Network
---5 ---1 RFC-792-
-
+
-
+
Redirect datagrams for the Host
---5 ---2 RFC-792-
-
+
-
+
Redirect datagrams for the Type of Service and Network
---5 ---3 RFC-792-
-
+
-
+
Redirect datagrams for the Type of Service and Host
---6 ---X N/A JBP-
X
X
X
X
Unassigned (Also see RFC-1700)
---7 ---0 N/A JBP-
?
?
?
?
Alternate Address for Host (Also see RFC-1700)
---8 ---0 RFC-792-
+
-
+
+
for echo message (also see Type 0)
---9 ---0 RFC-1256
-
+
?
?
Router Advertisement
--10 ---0 RFC-1256
-
+
?
?
Router Solicitation
--11 ---0 RFC-792-
-
+
-
+
time to live exceeded in transit
--11 ---1 RFC-792-
-
+
+
-
fragment reassembly time exceeded
--12 ---0 RFC-792-
-
+
+
-
pointer indicates the error (identifies the octet where an error was detected.)
--12 ---1 RFC-1108
-
+
?
?
Missing a required option
--12 ---2 RFC-1108
-
+
?
?
Bad length
--13 ---0 RFC-792-
+
-
+
+
for timestamp message
--14 ---0 RFC-792-
+
-
+
+
for timestamp reply message
--15 ---0 RFC-792-
+
-
+
+
for information request message
--16 ---0 RFC-792-
+
-
+
+
for information reply message
--17 ---0 RFC-950-
+
-
+
+
for address mask request message
--18 ---0 RFC-950-
+
-
+
+
for address mask reply message
--19 ---X SoloResv
X
X
X
X
Reserved (for Security) (Also see RFC-1700)
--20 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--21 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--22 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--23 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--24 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--25 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--26 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--27 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--28 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--29 ---X ZSu Resv
X
X
X
X
Reserved (for Robustness Experiment) (Also see RFC-1700)
--30 ---X RFC-1393
X
X
X
X
Traceroute (Also see RFC-1700)
--31 ---X RFC-1475
X
X
X
X
Reserved (for Security) (Also see RFC-1700)
--32 ---X DaviJohn
X
X
X
X
Mobile Host Redirect (Also see RFC-1700)
--33 ---X BillSimp
X
X
X
X
IPv6 Where-Are-You (Also see RFC-1700)
--34 ---X BillSimp
X
X
X
X
IPv6 I-Am-Here (Also see RFC-1700)
--35 ---X BillSimp
X
X
X
X
Mobile Registration Request (Also see RFC-1700)
--36 ---X BillSimp
X
X
X
X
Mobile Registration Reply (Also see RFC-1700)
--37 ---X Simpson-
X
X
X
X
Domain Name Request (Also see IANA ICMP Params)
--38 ---X Simpson-
X
X
X
X
Domain Name Reply (Also see IANA ICMP Params)
--39 ---X Markson-
X
X
X
X
SKIP (Also see IANA ICMP Params)
--40 ---X Simpson-
X
X
X
X
Photuris (Also see IANA ICMP Params)
--41 ---X Reserved
X
X
X
X
Reserved (Also see IANA ICMP Params) [This is a range of CODES from 41 through to 255.]
-255 ---X
---- ---- ---- ---- ---- ---- ---- Ignore below this line:
---* ---0 RFC-917-*-see proposal
?
?
?
?
for echo reply message (also see Type 8)
---* ---0 RFC-917-
?
?
?
?
*-see proposal
---* ---0 RFC-917-
?
?
?
?
*-see proposal
---* ---- RFC-1101
?
?
?
?
*-see proposal (obsel: 1101,961,924,901,880,840)
Query: This specifies it is used to question, ask or convey non error information.
Error: This specifies it is used in error events.
Host: Message expected from a host.
Gateway: Message expected from a gateway.Gateway has an ambiguous meaning since microsoft decided to change the industry standard of its meaning. In this case I refer to a Network layer routing device like a router for a subnet or the glossary definition from RFC-950- "A node connected to two or more administratively distinct networks and/or subnets, to which hosts send datagrams to be forwarded."
**:From RFC950:may be received from a gateway, or a host acting in lieu of a gateway.

Also try ftp://ftp.isi.edu/in-notes/iana/assignments/icmp-parameters

Original ICMP Spec: RFC-792-
Internet Standard Subnetting Procedure: RFC-950-
General Review of and Internet Host: RFC-1122
Assigned Numbers: RFC-1700

This ends the brief preview of an ICMP packet.

Comments and/or suggestions for this?: Email me at: dugan@passwall.com
Attempts have been made to make the tables appear as they should for LYNX users by forcing a common field width for fields being used by padding them with other printable characters. This is meant to allow for LYNX users to see the tables much like the Netscape and other web browser worlds might show them. However, from personal experience, some versions of LYNX still manage to munge the tables, making them use up several pages. It seems to be a problem with how earlier versions of LYNX dealt with tables, but the problem has not been entirely isolated.
Some have asked why this collection of on-line documents is so lacking of graphic content. To them I answer: faster downloads. Many of these pages are smaller than some pictures on many commercial web sites. You do not come here to look at my pictures. You come here to read content. Also, LYNX users benefit from this, and by using ALL text, people with ADA issues are able to use speech recognition software on the text to hear the words.
Copyright (C) 1999, 2000, 2001, 2002 by Michael Egan: All rights reserved.
A Special License: No part of this document may be used for profit without the consent of the author Michael Egan in writing. Content may be duplicated for retransmission for non-profit purposes as long as the copyright and license remain included in their entirety. The content is provided "as-is" and I take no responsibility on the content's truthfulness or consistency. Errors may exist in these documents, but acting upon these errors is left up to the reader to verify by a third party that will take responsibility for fact verification. When notified of errors or inconsistencies, attempts will be made to rectify the errors.
In plan English this is meant to do many things: This copyright is meant to exist so that others may not profit from this work as published in paper form, or by duplicating the content to place advertisements over it and generate income. It is also meant to exist to prevent people from publishing this work as their own and receiving profit from this process on research they did not perform. It is not meant to stop a professor from running off copies to use in their classes for their students. It is also not meant to stop the student from printing up copies for their own education. How depressing it would be to find your work published in book form without your permission, or compensation. Another reason for this Copyright is to limit the effect of the mistakes I have made within this document before I was able to complete it. It would be even sadder to notice my mistakes in print and criticized before I could resolve them. Eventually, after I finish this work, I may retain copyright, but eliminate the license.