9.2 ICMP, ping, and traceroute Evidence Boundaries
ping and traceroute provide path evidence, but cannot diagnose a fault alone. Timeouts can result from loss, filtering, rate limits, return-path failures, or a device declining to reply. This lesson separates what the tools actually measure, then combines their results with TCP, TLS, and HTTP checks against the same target.
ICMP is a control and error-reporting protocol carried by IP, not an independent out-of-band channel. IPv4 uses Protocol 1 for ICMP; ICMPv6 uses Next Header 58. Their type/code spaces differ and cannot be used interchangeably.
1. ICMP reports network conditions and can itself be lost
Common IPv4 messages include:
| Type | Purpose |
|---|---|
| Echo Request 8 / Echo Reply 0 | ping requests and replies |
| Destination Unreachable 3 | Network, host, protocol, or port unreachable, and fragmentation needed; the code distinguishes the condition |
| Redirect 5 | Suggests another next hop; acceptance is usually restricted by policy |
| Time Exceeded 11 | TTL expiry or fragment-reassembly timeout |
| Parameter Problem 12 | A problem in an IPv4 header field |
An ICMP error quotes part of the original packet. IPv4's basic format includes the original IP header and at least the first 8 payload bytes to help correlate the flow; extensions and implementations can carry more. NATs, firewalls, and load balancers must inspect this quotation too, not just the outer ICMP addresses. RFC 792
ICMP is best effort. Devices may rate-limit generated errors, and policy may discard them. No error reply does not prove the network is healthy. An unreachable message needs its type/code and quoted packet checked against the probe.
To prevent error loops, IPv4 generally avoids sending errors in response to ICMP errors, broadcasts, multicasts, or non-initial fragments. ICMPv6 has separate rules, including a multicast exception for Packet Too Big. IPv4 suppression rules cannot be copied unchanged. RFC 4443 §2.4
2. ping checks Echo round trips, not application health
This example uses Linux/iputils syntax. Replace documentation address 192.0.2.10 with your lab target. Use 127.0.0.1 to check the local stack:
ping -c 4 192.0.2.10An Echo Reply shows that the request and reply completed a round trip under the policy and path conditions at that time. It does not prove:
- TCP port 443 accepts connections.
- The TLS certificate matches the hostname.
- The HTTP application is healthy.
- Large packets and small Echo packets receive identical queue and policy treatment.
- Forward and reverse paths match.
- Future loss and latency remain stable.
An Echo timeout does not prove the host is down. A device can filter Echo or deprioritize control-plane replies while forwarding application traffic. ping answers “did this Echo return?” well; it does not issue health certificates for the whole service.
3. traceroute probes successive TTL or Hop Limit values
Classic Unix UDP traceroute probes high destination ports with increasing TTL values:
- With TTL=1, the first hop decrements it to 0, drops the packet, and may send ICMP Time Exceeded.
- With TTL=2, a probe can normally reach the second hop.
- At the destination, an unused UDP port produces Port Unreachable, allowing traceroute to recognize the endpoint.
These commands limit probes to 12 hops with a 1-second wait per probe. Common Linux implementations support these options; check the local manual on other systems:
traceroute -m 12 -w 1 192.0.2.10
# Use ICMP Echo or TCP SYN probes
traceroute -I -m 12 -w 1 192.0.2.10
traceroute -T -p 443 -m 12 -w 1 192.0.2.10Windows tracert uses ICMP Echo by default and recognizes the target through Echo Reply. TCP SYN probes usually recognize it through SYN-ACK or RST; intermediaries can also generate responses, so verify their source. TCP traceroute is closer to HTTPS port policy, but completes neither TLS nor HTTP validation.
4. A hop list is not a complete topology map
A * can mean a filtered or rate-limited reply, a lost probe, or a broken return path. It need not mean the router stopped forwarding. The displayed address is the source chosen for the ICMP response, not necessarily the probe's ingress or egress interface.
Equal-cost multipath (ECMP) commonly hashes flows. Changing a probe's five-tuple may change its path, so several addresses on one row do not mean one packet bounced repeatedly between those routers. NAT, MPLS, and tunnels may hide hops, and the return path may differ from the forward path.
Paris traceroute and similar techniques try to stabilize fields used for load balancing, reducing false topology inferred from the probes themselves. The result still describes one time and probe type, not a guarantee that application traffic takes the same path.
5. ICMP and path MTU discovery
IPv4 Fragmentation Needed and ICMPv6 Packet Too Big support classic PMTUD. They differ from traceroute's Time Exceeded messages. See 8.3 for the full diagnostic process.
Dropping all ICMP can break PMTUD. ICMPv6 also carries basic functions such as Neighbor Discovery. Set rules by type, code, and interface role, validate quoted errors, and apply reasonable rate limits instead of treating every message as optional probe traffic.
6. Point different probes at the same target
This Linux example needs getent, iproute2, iputils, traceroute, netcat, and curl. Set both variables to your own target and confirm the chosen IPv4 address belongs to that hostname. curl's --resolve fixes the connection address while preserving TLS SNI and certificate hostname validation:
TARGET_HOST=example.com
TARGET_IPV4=192.0.2.10
# Compare DNS results with local route selection
getent ahostsv4 "$TARGET_HOST"
ip route get "$TARGET_IPV4"
# Collect ICMP and transport evidence for the same IPv4 address
ping -c 4 "$TARGET_IPV4"
traceroute -m 12 -w 1 "$TARGET_IPV4"
nc -vz -w 3 "$TARGET_IPV4" 443
# Connect directly to the chosen HTTPS address with hostname validation
curl -v --noproxy '*' --connect-timeout 3 --max-time 10 \
--resolve "${TARGET_HOST}:443:${TARGET_IPV4}" "https://${TARGET_HOST}/"A successful nc check establishes TCP reachability only; curl also exercises TLS and HTTP. Record the source network, address family, time, probe type, and errors, then correlate captures or counters. If applications use a proxy, test that path separately instead of extrapolating from these direct-connection results.
7. Check your understanding
- Why is ICMP not an independent out-of-band channel?
- What does a successful ping prove, and what does it leave untested?
- How do UDP, ICMP Echo, and TCP traceroute usually recognize the destination?
- What can cause multiple addresses or stars at one hop?
- Why must ICMPv6 not be blocked entirely?
Next lesson: 9.3 NAT, NAPT, and Traversal Boundaries.