ICMP: The Network's Control Protocol

So far, we've learned how Linux decides where a packet should go (routing) and how it discovers the MAC address of the next hop (ARP).

But what happens when something goes wrong?

What if:

• The destination doesn't exist?
• A router can't forward the packet?
• A packet loops endlessly through the network?
• The packet is too large to pass through a link?

Unlike TCP or UDP, which transport application data, the Internet Control Message Protocol (ICMP) is responsible for communicating information about the network itself.

Think of ICMP as the network's control and diagnostic protocol.

What Is ICMP?

ICMP is part of the Internet Protocol (IP) suite and operates alongside IP.

Instead of carrying application data, ICMP carries control messages.

These messages help computers and routers:

• Report errors
• Diagnose connectivity problems
• Exchange network information

For example, a router may send an ICMP message to tell a sender:

"I can't reach that destination."

or

"Your packet is too large."

Common ICMP Messages

ICMP defines many different message types.

Some of the most common are:

Each message helps computers understand what happened to a packet after it left the sender.

Ping Uses ICMP

The most familiar use of ICMP is the ping command.

For example:

ping 8.8.8.8

ping sends an ICMP Echo Request.

If the destination is reachable, it responds with an ICMP Echo Reply.

Computer A         Computer B
     │                 │
     │  Echo Request   │
     │────────────────►│
     │                 │
     │  Echo Reply     │
     │◄────────────────│

This simple exchange tells us:

• The destination is reachable.
• The network path is working.
• The host is responding to ICMP.

It does not tell us whether a particular application, such as a web server or SSH server, is available.

A server can ignore ICMP requests while still serving web traffic normally.

Time to Live (TTL)

Every IP packet contains a field called Time to Live (TTL).

Despite its name, TTL is not measured in seconds.

Instead, it is a counter.

Every router that forwards a packet decreases the TTL by one.

If the value reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the sender.

This prevents packets from circulating forever if a routing loop occurs.

Without TTL, a single routing mistake could flood the network indefinitely.

How Traceroute Works

The traceroute command is built on the TTL mechanism.

Instead of sending one packet, it sends many packets with increasing TTL values.

For example:

TTL = 1

The first router decreases the TTL to zero and returns:

ICMP Time Exceeded

Now traceroute knows the address of the first router.

It repeats the process:

TTL = 2

The second router responds.

Then:

TTL = 3

And so on until the destination is reached.

This is how traceroute discovers every hop between your computer and the destination.

ICMP Is Not an Application Protocol

A common misconception is that ICMP works like TCP or UDP.

It doesn't.

ICMP:

• Has no ports.
• Does not establish connections.
• Does not transport application data.

Instead, it exists to support the operation of IP networks.

Applications like ping and traceroute simply use ICMP to gather information about the network.

Looking Ahead

By now, we've seen how a computer:

• Chooses the next hop using the routing table.
• Discovers the next hop's MAC address using ARP.
• Receives status and error information using ICMP.

One important question remains:

How do we find the IP address of a server in the first place?

Humans prefer names like:

example.com

Computers communicate using IP addresses.

In the next chapter, we'll explore the Domain Name System (DNS) and learn how those names are translated into the IP addresses that make communication possible.