1. ICMP (Internet Control Message Protocol) Computer Networks By: Saeedeh Zahmatkesh 90-91 spring

2. ICMP is used to send debugging information and error reports between hosts, routers and other network devices ICMP provides communication between the Internet Protocol software on one machine and the Internet Protocol software on another ICMP 2

3. ICMP Error Message Data Historically, ICMP errors returned the offending IP header and the 1st 8 data bytes No longer adequate with more complicated headers like IP in IP New rules say that it should contain as much as original datagram as possible, without the length of ICMP datagram being > 576 bytes (standard Internet min size) 3ICMP

4. ICMP Message Delivery In all other respects, an ICMP message travels as would any other datagram No additional reliability or priority The only difference between a normal datagram and a datagram containing an ICMP message occurs in the event that the datagram containing the ICMP causes an error  No error messages are sent for ICMP error message failures 4ICMP

5. ICMP messages can be lost or discarded  Errors in ICMP messages should not generate additional ICMP messages ICMP messages are not allowed to be sent in response to (RFC1812):  an ICMP error message (ok for queries)  datagrams failing header validation tests  broadcast or multicast IP datagrams  link-layer broadcast or multicast frames  invalid source address  any fragment other than the first ICMP 5

6. ICMP is an integral part of IP  But it is actually encapsulated within IP (Protocol=1) IP headerICMP message 20 bytes IP datagram ICMP 6

7. ICMP Message Types Type FieldICMP Message Type 0Echo Reply 3Destination Unreachable 4Source Quench 5Redirect 8Echo Request 9Router Advertisement 10Router Solicitation 11Time Exceeded 7ICMP

8. Type FieldICMP Message Type 12Parameter Problem 13Timestamp Request 14Timestamp Reply 15Info Request (obsolete) 16Info Reply (obsolete) 17Address Mask Request 18Address Mask Reply ICMP Message Types 8ICMP

9. The ping program The ping program is a useful diagnostic tool  It uses ICMP echo request/reply packets to test whether a device is reachable 9ICMP

10. The identifier allows ping to identify multiple instances of ping running at the same time on the same host The sequence number allows us to see if packets disappeared The round-trip time is also calculated The ping program 10ICMP

11. ICMP Destination Unreachable Message When a router cannot forward or deliver an IP datagram, it sends a type 3 ICMP message (destination unreachable) 11ICMP

12. Destination Unreachable Codes 0Network unreachable generated by a router if a forwarding path (route) to the destination network is not available 1Host unreachable generated by a router if a forwarding path (route) to the destination host on a directly connected network is not available (does not respond to ARP); 2Protocol unreachable generated if the transport protocol designated in a datagram is not supported in the transport layer of the final destination 3Port unreachable generated if the designated transport protocol (e.g., UDP) is unable to demultiplex the datagram in the transport layer of the final destination but has no protocol mechanism to inform the sender 12ICMP

13. 4Frag needed and DF set generated if a router needs to fragment a datagram but cannot since the DF flag is set 5Source route failed generated if a router cannot forward a packet to the next hop in a source route option 6Destination network unkown This code SHOULD NOT be generated since it would imply on the part of the router that the destination network does not exist (net unreachable code 0 SHOULD be used in place of code 6); 7Destination host unkown generated only when a router can determine (from link layer advice) that the destination host does not exist … Destination Unreachable Codes 13ICMP

14. Congestion and Datagram Flow Control Two common situations may cause a router to become congested with packets  A high-speed sender transmits packets faster than an intermediate network (router) can handle them  Many senders transmit packets through the same router 14ICMP

15. Congestion and Datagram Flow Control In order to signal senders that it can’t handle the load, a router sends an ICMP source quench message Ideally, such a message should be sent before a router is forced to drop packets Senders reduce transmission rate upon receipt of a source quench message 15ICMP

16. ICMP Source Quench Message Type (8-bit): 4 Code (8-bit): 0 Checksum (16-bit) Unused (Zero Field, 32-bit) 16ICMP

17. Route Change Requests Routers (not hosts) are responsible for keeping routing information up-to-date Routers are assumed to know correct routes Hosts begin with minimal routing information and learn new routes from routers A host may boot up knowing the address of only one router – but that may not be the best route for a given datagram 17ICMP

18. When a router detects a host using a non- optimal route it:  Sends an ICMP redirect message to the host  Forwards the message A host is expected to then update its routing table Route Change Requests 18ICMP

19. Not applicable to intermediate routers Route Change Requests 19ICMP

20. ICMP Redirect Message 20ICMP Redirect Codes 0Redirect for the network (obsolete) 1Redirect for the Host 2Redirect for the type-of-service and network (obsolete) 3Redirect for the type-of-service and Host

21. Circular or Excessively Long Routes To avoid cycles  datagrams contain a TTL field (also called the hop count) which is decremented until it reaches zero When fragmented datagrams are received a reassembly timer is started  if all the fragments are not received before the timer expires we say a timeout has occurred 21ICMP

22. ICMP Time Exceeded Message If either the TTL field reaches zero or a fragmentation reassembly timeout occurs, an ICMP time exceeded message is sent 22ICMP

23. 23ICMP

24. Links http://www.wiziq.com/tutorial/116986-Chapter-4-Internet- Control-Message-Protocol http://www.wiziq.com/tutorial/116986-Chapter-4-Internet- Control-Message-Protocol http://fab.cba.mit.edu/classes/MIT/961.04/people/neil/ip. pdf http://fab.cba.mit.edu/classes/MIT/961.04/people/neil/ip. pdf http://www.sans.org/security- resources/idfaq/icmp_misuse.php http://www.sans.org/security- resources/idfaq/icmp_misuse.php ICMP24