9.2 ICMP, ping, and traceroute Evidence Boundaries
To determine where a request disappears along the path, you reach for ping and traceroute, only to find that the tool output doesn't directly equate to a definitive diagnosis.
ICMP is a control and error-reporting protocol within the IP suite, not a parallel "out-of-band" channel. In IPv4, ICMP messages are encapsulated within IPv4 packets (Protocol = 1); in IPv6, ICMPv6 uses Next Header = 58. Their type/code spaces are distinct, and IPv4 types should not be directly mapped to IPv6.
1. ICMP Reports Network-Layer Conditions, Without Guarantee of Reliable Delivery
Common IPv4 messages:
| Type | Purpose |
|---|---|
| Echo Request 8 / Echo Reply 0 | Foundation of ping |
| Destination Unreachable 3 | Indicates network/host/protocol/port unreachable, or fragmentation required; the specific code determines the exact meaning |
| Redirect 5 | Router suggests the host use a different next hop; modern hosts and networks often restrict acceptance of such messages |
| Time Exceeded 11 | Occurs when TTL expires or fragment reassembly times out |
| Parameter Problem 12 | Identifies issues in the IPv4 header fields |
ICMP error messages include the header of the offending packet and sufficient original packet data to allow the sender to correlate the error with the specific flow. When NAT, firewalls, or load balancers process ICMP errors, they must parse this quoted packet to correctly associate the error with the intended connection.
ICMP operates on a best-effort basis, routers frequently rate-limit or drop ICMP messages. The absence of an ICMP error does not imply the absence of a network issue. Similarly, receiving a "destination unreachable" message must be interpreted in context: by examining both the type/code and the quoted flow data.
Protocols also restrict which packets trigger ICMP errors to prevent error storms. For example, an ICMP error should not generate another ICMP error in response, and certain broadcast, multicast, or non-initial fragments should not trigger standard ICMP errors.
2. ping Measuring the Echo Path, Not Application Health
ping -c 4 192.0.2.10An Echo Reply confirms that, under the current policy/path/time conditions, an Echo Request was received and responded to. It does not confirm:
- That TCP port 443 is reachable;
- That the TLS certificate is valid;
- That the HTTP application is healthy;
- That large packets and small Echo packets follow the same queue or policy;
- That the reverse path matches the forward path;
- That packet loss or latency remains consistently stable.
An Echo timeout does not indicate host failure: firewalls can block Echo requests, and devices can lower the priority of control-plane replies while still forwarding data traffic. Therefore, ping provides evidence, not a final verdict.
3. traceroute Use Incrementing Hop Limit/TTL to Generate Time Exceeded Messages
Classic Unix UDP traceroute sends UDP probe packets with TTL values of 1, 2, 3, and so on, targeting a high destination port:
- The first hop reduces the TTL to 0, discards the packet, and responds with an ICMP Time Exceeded message;
- The second hop, when TTL is set to 2, returns a Time Exceeded message;
- When the packet reaches the destination, if no listener is running on the UDP port, the destination returns an ICMP Port Unreachable message, ending the trace.
traceroute 192.0.2.10
# Linux Implement constant support ICMP or TCP SYN probe, Specific option Check local machine man page
traceroute -I 192.0.2.10
traceroute -T -p 443 192.0.2.10Windows tracert defaults to using ICMP Echo instead of the Unix-style UDP high-port probing. TCP traceroute provides a closer approximation to real-world HTTPS firewall behavior, but still does not replace TLS/HTTP-level testing.
4. Traces in Trace do not represent a complete topology map
* may indicate that ICMP replies were filtered or rate-limited, the return path is unreachable, or probes were lost, this does not necessarily mean the router is not forwarding traffic. The hop address is the source address selected when responding to an ICMP request, and it may not correspond to the ingress or egress interface visible on the forward path.
ECMP (Equal-Cost Multi-Path) and per-flow hashing can cause different five-tuple probes to traverse different paths. Multiple addresses appearing in a single trace row may reflect load-balanced paths, not actual routing back-and-forth within a single packet. NAT, MPLS, or tunneling can hide hops, and asymmetric routing can cause ICMP replies to follow a different return path than the original probe.
To reduce false topology inferences caused by ECMP, tools like Paris traceroute attempt to stabilize the load-balancing hash input. Even with such measures, a trace remains only a snapshot of observations taken at a specific moment and under a particular probe set.
5. ICMP and PMTUD
IPv4 fragmentation required and ICMPv6 Packet Too Big are key feedback mechanisms in PMTUD. These are distinct from the Time Exceeded messages used in traceroute. A complete MTU/PMTUD/PLPMTUD diagnosis is covered in 8.3.
All ICMP messages must be carefully managed to avoid disrupting PMTUD, especially in IPv6 environments. A reasonable policy is to allow only the ICMP types and codes necessary for protocol operation, implement stateful validation and rate limiting, and not treat ICMP traffic as purely malicious.
6. Diagnose by Running Multiple Probes Together
# DNS / route decision
getent ahosts example.com
ip route get 192.0.2.10
# ICMP evidence
ping -c 4 192.0.2.10
traceroute 192.0.2.10
# Target transport/application evidence
nc -vz -w 3 192.0.2.10 443
curl -v --connect-timeout 3 https://example.com/Commands vary by OS and package, and high-rate probing is not performed on unauthorized endpoints. A reliable conclusion must record the source network, destination address family, timestamp, probe type, and packet capture or counter, rather than simply attaching a traceroute screenshot.
7. Acceptance Questions
- Why is ICMP not an out-of-band protocol?
- What does a successful ping prove, and what does it fail to prove?
- How do the termination signals differ between UDP, ICMP Echo, and TCP traceroute?
- What are possible reasons for multiple router addresses appearing in a single traceroute line?
- Why can't ICMPv6 be completely blocked for "security" reasons?
Next lesson: 9.3 NAT, NAPT, and Penetration Boundaries.
References:
- RFC 792: Internet Control Message Protocol (ICMP)
- RFC 793: Transmission Control Protocol (TCP)
- RFC 1812: Requirements for Internet Hosts – Configuration
- RFC 4443: ICMPv6 Message Definitions
- RFC 6891: Requirements for ICMPv6 in IPv6 Networks