Internet Control Message Protocol (ICMP) for CCNA

Learn how ICMP and ICMPv6 report IP errors, support ping and traceroute, handle TTL and path MTU discovery, and guide CCNA troubleshooting.

Internet Control Message Protocol (ICMP) is a network-layer control and diagnostic protocol used with IP. It does not carry ordinary application data such as web pages, email, or file contents. Instead, it reports delivery problems and provides operational information that helps hosts and network devices understand what happened to an IP packet.

Network administrators commonly encounter ICMP through ping and traceroute. ICMP is also important for routing behavior, path MTU discovery, IPv6 neighbor discovery, and controlled error reporting. Understanding the message type, code, generating device, and packet path is essential when interpreting diagnostic output.

What ICMP Does

IP is designed to deliver packets, but it does not guarantee delivery and does not provide a built-in mechanism for explaining every failure. ICMP supplies that control-message function. A router or host can generate an ICMP message when it cannot forward a packet, when a packet expires, or when a diagnostic request needs a response.

Error reporting: A router can report that a destination is unreachable, a packet's lifetime expired, or a packet cannot be forwarded because of its size.
Operational information: Devices can communicate information used by hosts to select paths, discover routers, or maintain IPv6 neighbor relationships.
Diagnostics: Echo Request and Echo Reply messages allow a utility such as ping to test IP reachability and measure round-trip performance.

ICMP is encapsulated directly inside an IPv4 or IPv6 packet. It is not transported by TCP or UDP and therefore does not use TCP or UDP port numbers. A firewall may still filter ICMP, but it evaluates ICMP message types and codes rather than application ports.

ICMP in the Protocol Stack

Applications usually use TCP or UDP for transport services. ICMP is different: it sits alongside TCP and UDP as a protocol carried by IP.

Application data
      |
   TCP or UDP  -----------+
      |                   |
      +------ IP ---------+---- IPv4 protocol 1: ICMP
                          +---- IPv6 next-header 58: ICMPv6

A TCP/UDP port number identifies a transport-layer service, such as a web or DNS service. An IP protocol number identifies the payload protocol carried by IPv4. IPv4 assigns ICMP protocol number 1. IPv6 identifies ICMPv6 with next-header value 58. These numbers are not port numbers.

The basic ICMP message begins with four important fields:

Type: Identifies the broad message category, such as Echo Request, Echo Reply, Destination Unreachable, or Time Exceeded.
Code: Provides more detail within the type, such as network unreachable, host unreachable, or port unreachable.
Checksum: Helps detect corruption in the ICMP message.
Message-specific fields: Additional values depend on the message. For example, an echo message includes an identifier and sequence number, while a Packet Too Big message includes an MTU value.

ICMP error messages generally include the original IP header and a portion of the packet that caused the error. This lets the sender identify which communication or transport flow was affected. The exact amount and format depend on the IP version and message type.

Why Routers and Hosts Generate ICMP

A router generates ICMP when it must discard or reject a packet and can provide useful feedback to the source. Examples include an unavailable route, an expired TTL, or an IPv4 packet that cannot be forwarded without fragmentation when fragmentation is prohibited.

A host can generate ICMP when it receives a packet addressed to an unavailable service, receives an invalid or unsupported parameter, or answers an Echo Request. IPv6 hosts and routers generate ICMPv6 for additional functions such as router discovery and neighbor discovery.

ICMP is not guaranteed to be delivered. A device may filter, suppress, or rate-limit ICMP messages, and an ICMP error is not generated for every possible failure. Therefore, the absence of an ICMP response does not identify the exact cause of a timeout.

Common ICMPv4 Error Messages

ICMP error messages describe a forwarding or delivery problem. The message source is significant: a response from the local gateway, an intermediate router, or the destination host points to different investigation areas.

Message type	Typical code or condition	Generated by	Meaning	Common troubleshooting implication
Destination Unreachable	Network unreachable	Router	The router has no usable path to the destination network.	Check the routing table, default route, dynamic routing, and next-hop reachability.
Destination Unreachable	Host unreachable	Router or host	The destination host cannot be reached on an otherwise known network.	Check local delivery, ARP, IPv6 neighbor discovery, host status, and subnet configuration.
Destination Unreachable	Protocol unreachable	Destination host or router	The IP packet's upper-layer protocol is not supported or available.	Check the IP protocol and endpoint implementation; this is less common in ordinary host testing.
Destination Unreachable	Port unreachable	Destination host or firewall	No application is listening on the targeted UDP port, or policy rejects it.	For UDP testing, the host may have been reached even though the service is unavailable.
Destination Unreachable	Administratively prohibited or filtered	Router or firewall	An ACL, firewall, or security policy refuses forwarding or delivery.	Inspect filtering policy and identify which device generated the response.
Time Exceeded	TTL or hop limit expired in transit	Router	The packet reached a hop with a lifetime value of zero.	Normal for intermediate traceroute probes; unexpected for ordinary traffic can indicate a loop or excessive path length.
Parameter Problem	Invalid or unsupported header information	Router or host	A device cannot process a required part of the IP header or option information.	Inspect packet headers, extension processing, and interoperability.
Redirect	Better next hop available	Router	A host used a router, but another router on the same local network is a more appropriate next hop.	Check host gateway configuration; redirects are limited, often disabled, and should not be accepted blindly.

Destination Unreachable Conditions

Network unreachable means the generating router cannot find a usable route to the destination network. A missing static or dynamic route is a common cause. Host unreachable is more specific to a destination host or local-delivery problem, although device implementations and codes vary.

Protocol unreachable indicates that the destination does not support the IP protocol identified in the packet. Port unreachable is especially relevant to UDP. A UDP probe sent to a closed or unavailable port may receive this response, which can prove that the destination or a filtering device generated an explicit rejection. It does not prove that every UDP port or application on the host is unavailable.

An administratively prohibited or filtered response indicates a policy decision, commonly from an ACL or firewall. This differs from a silent drop. With an explicit unreachable response, some device tells the sender that delivery was rejected. With a silent drop, the sender receives no response and eventually reports a timeout. Both can result from security policy, but the diagnostic evidence is different.

Redirect Messages

An ICMP Redirect can advise a host that a better next hop is available. A typical limited case occurs when a host sends a packet to a router, and that router must forward the packet through another router on the same local network. The first router may forward the packet and also tell the host to use the more direct router in the future.

Redirects are not a substitute for correct host or routing configuration. They can create security concerns if accepted from untrusted sources, so many networks disable them or restrict their use.

TTL, Hop Limit, and Time Exceeded

The IPv4 header contains a Time To Live (TTL) field. Despite its name, ordinary routers use it primarily as a hop count. Each routed hop decrements TTL by at least one before forwarding the packet.

IPv6 uses a corresponding field called Hop Limit. Each IPv6 router decrements Hop Limit at each routed hop. If TTL or Hop Limit reaches zero, the router discards the packet and normally sends an ICMP Time Exceeded message to the source.

Source -- TTL 3 --> Router A -- TTL 2 --> Router B -- TTL 1 --> Router C
                                                               |
                                             TTL becomes 0: discard packet
                                                               |
                                             ICMP Time Exceeded to source

This mechanism prevents a packet caught in a routing loop from circulating forever. A routing loop causes the packet to pass repeatedly between routers until its TTL or Hop Limit expires.

Time Exceeded can also relate to fragment reassembly timeout, but the TTL-expiration condition is the one most visible in traceroute.

Echo Messages and Ping

An Echo Request is an ICMP diagnostic message sent by ping. A reachable destination normally returns an Echo Reply. The request and reply carry identifiers, sequence values, and optional data so the sender can match each reply with a request and calculate elapsed time.

Host A                                      Host B
  |----------- ICMP Echo Request ----------->|
  |<---------- ICMP Echo Reply --------------|
  |       measure round-trip time            |

Ping can provide evidence about:

Whether an IP address responds to the selected type of probe.
Round-trip time and variation between replies.
Packet loss during the test.
Whether a particular source address or interface can reach the destination.

A successful ping does not prove that DNS works, that a TCP port is open, that an application is healthy, or that all traffic directions and packet sizes work. A failed ping does not prove that the host is down: an ACL, firewall, endpoint setting, or ICMP rate limit may block Echo Request or Echo Reply.

Ordered Ping Workflow

Local loopback: Test the local protocol stack, such as 127.0.0.1 for IPv4 or ::1 for IPv6.
Local interface address: Test the host's configured address to expose interface or local configuration issues.
Default gateway: Test the first routed hop. Failure here suggests a VLAN, Layer 2, interface, subnet-mask, gateway, or local filtering problem.
Remote network: Test a known address in another subnet to examine routing and policy beyond the local segment.
Remote host and service: Test the intended endpoint, then separately verify DNS and the application protocol or port.

When source selection matters, use an extended ping or specify a source address. A ping sourced from the wrong interface can test a different route than the one used by production traffic.

Traceroute and Tracert

Traceroute on Linux and macOS and tracert on Windows discover a path by sending probes with progressively increasing TTL or Hop Limit values.

The first probes use a value of 1. The first router decrements it to zero, discards the probe, and returns ICMP Time Exceeded.
The next probes use a value of 2. The first router forwards them, and the second router returns Time Exceeded.
The process continues with larger values until probes reach the destination or the utility reaches its limit.

The final response depends on the implementation and probe type. A UDP-based traceroute may receive ICMP Port Unreachable from the destination, indicating that the probe reached the destination but no target UDP service accepted it. An ICMP-based implementation may receive Echo Reply. A Windows trace commonly uses probes whose final response behavior differs from a traditional UDP traceroute. Always interpret the utility and its options in context.

An asterisk indicates that a probe did not produce a response before the timeout. Possible causes include filtered Time Exceeded messages, control-plane rate limiting, a router configured not to respond, a return-path problem, or an actual forwarding failure. If later hops and the destination respond, the silent hop may simply be suppressing traceroute replies.

Paths can vary because of asymmetric routing, where the return path differs from the outbound path, and per-flow load balancing, where different probe flows use different equal-cost paths. A changing hop list is not automatically evidence of a fault.

ICMPv4 and ICMPv6

ICMPv4 supports IPv4 error reporting and diagnostics. ICMPv6 performs those functions for IPv6 but has a broader operational role: core IPv6 functions use ICMPv6 messages.

Function	ICMPv4 behavior	ICMPv6 behavior	Operational significance
Echo testing	Echo Request and Echo Reply support ping.	Echo Request and Echo Reply support IPv6 ping.	Useful for reachability, latency, and loss, subject to filtering.
Router discovery	Not the normal IPv4 method for host default-router discovery.	Router Solicitation and Router Advertisement are part of IPv6 Neighbor Discovery.	Blocking required messages can prevent hosts from learning IPv6 router and prefix information.
Neighbor discovery	IPv4 commonly uses ARP for local address resolution.	Neighbor Solicitation and Neighbor Advertisement support resolution and reachability.	Required for ordinary on-link IPv6 communication and duplicate address detection.
Oversized packet feedback	Fragmentation Needed reports that a packet cannot be forwarded without fragmentation when DF is set.	Packet Too Big reports the maximum MTU for the next path segment.	Important to Path MTU Discovery.
Control protocol identification	IPv4 protocol number 1.	IPv6 next-header value 58.	Filters must match the correct IP version and ICMP message types.

IPv6 Neighbor Discovery

IPv6 Neighbor Discovery Protocol (NDP) is carried by ICMPv6. It replaces several functions associated with IPv4 ARP and supports router discovery and neighbor reachability.

Router Solicitation (RS): A host asks local routers to send router information instead of waiting for a periodic advertisement.
Router Advertisement (RA): A router supplies prefix, default-router, and other IPv6 configuration information.
Neighbor Solicitation (NS): A host resolves a neighbor's link-layer address, checks reachability, or performs duplicate address detection.
Neighbor Advertisement (NA): A neighbor responds to an NS or announces address and link-layer information.

Because these messages support normal IPv6 operation, indiscriminately blocking ICMPv6 can break address configuration, neighbor resolution, default-router discovery, and reachability. IPv6 security policy should permit required NDP and error messages while controlling unwanted traffic.

Path MTU Discovery

The Maximum Transmission Unit (MTU) is the largest packet that a link can carry in one frame. The smallest MTU along an end-to-end path limits the useful packet size for that path.

In IPv4, a router may fragment a packet when it is too large for the outgoing link unless the packet's Don't Fragment (DF) behavior prevents fragmentation. If DF prevents forwarding, the router can discard the packet and send an ICMP Destination Unreachable condition commonly called Fragmentation Needed. The message can include the next-hop MTU, allowing the sender to reduce its packet size.

IPv6 routers do not fragment packets in transit. If an IPv6 packet is too large for the next link, the router discards it and sends an ICMPv6 Packet Too Big message containing the relevant MTU. The source uses this information for Path MTU Discovery.

Source -- oversized packet --> Router -- smaller-MTU link --> Destination
                                  |
             IPv4: ICMP Fragmentation Needed
             IPv6: ICMPv6 Packet Too Big
                                  |
                         Source lowers packet size

If a firewall blocks these feedback messages, the sender may continue transmitting packets that cannot cross the path. This creates a PMTU black hole: small pings or small application messages work, while large web responses, file transfers, or tunnel traffic stalls. Testing different packet sizes and checking tunnel and interface MTUs can expose the problem.

Security and Operational Controls

ICMP is useful but can be abused for reconnaissance, reflection or flood traffic, tunneling, spoofed error messages, and malicious redirects. These risks do not justify blocking all ICMP. Overly broad blocking can hide useful errors, break Path MTU Discovery, interfere with traceroute, and disrupt IPv6 Neighbor Discovery.

Balanced controls include:

Permit only the ICMP types and codes required by the network design.
Filter messages at appropriate boundaries and in the correct direction.
Rate-limit replies to protect router CPU and control-plane resources.
Use control-plane protection to limit traffic addressed to the device itself.
Inspect ICMP error messages in relation to an existing flow where stateful firewalls support that behavior.
Restrict or disable redirects when they are not required.
Permit essential ICMPv6 Neighbor Discovery and Packet Too Big messages.

Firewalls and ACLs can permit, deny, inspect, or rate-limit ICMP based on IP version, message type, and code. An instructional Cisco IOS example is shown below; it is not a universal production policy. Direction, stateful inspection, logging volume, and required IPv6 control traffic must be evaluated before deployment.

ip access-list extended EDGE-IN
 permit icmp any any echo
 permit icmp any any echo-reply
 permit icmp any any time-exceeded
 permit icmp any any unreachable
 deny ip any any log

CCNA Troubleshooting Workflow

Use ICMP results as evidence, not as an isolated verdict. First verify the device's state and addressing, then test progressively farther points in the path. Avoid changing configuration until the failure domain is identified.

Useful Cisco IOS Commands

ping 192.0.2.1
ping
ping ipv6 2001:db8:10::1
traceroute 198.51.100.10
traceroute ipv6 2001:db8:20::10
show ip interface brief
show ipv6 interface brief
show ip route
show ipv6 route
show access-lists

The interactive Cisco IOS ping supports extended options such as source interface or source address, repeat count, packet size, timeout, and Don't Fragment behavior. These options help test the same source and packet characteristics used by the failing application.

Endpoint equivalents include:

ping 192.0.2.1
ping -6 2001:db8:10::1
tracert 198.51.100.10       (Windows)
traceroute 198.51.100.10    (Linux/macOS)

Exact traceroute probe behavior varies by operating system, implementation, and command options. That difference affects the final response and which firewall rules are involved.

Interpreting Results

Observed result	Likely meaning	What it does not prove	Next verification step
Echo replies with stable delay	The tested IP path and ICMP exchange are working.	That DNS, TCP ports, or the application are healthy.	Test name resolution and the required service or port.
Some replies are missing	Loss, congestion, filtering, or rate limiting may exist.	That the endpoint is completely unreachable.	Repeat from multiple points and compare interface counters and policies.
Destination unreachable	A device explicitly reports a forwarding or delivery problem.	That every route or service is unavailable.	Identify the generator, inspect its route table, and review ACLs or firewall rules.
Timeout	No response returned before the utility's timer expired.	That the destination is down; responses may be filtered or rate-limited.	Test the gateway, trace the path, inspect both directions, and test another protocol.
Traceroute stops at one hop	A response is missing at or after that point, or the path is failing there.	That the silent router discarded all forwarding traffic.	Check later hops, destination reachability, routing, ACLs, and ICMP rate limits.
Small packets work but large transfers fail	A path MTU or fragmentation-feedback problem is possible.	That basic IP reachability is sufficient for all traffic sizes.	Test packet sizes, DF behavior, interface MTUs, tunnels, and PMTU-related ICMP.

Example: Gateway Failure

If a host can ping itself but cannot ping its default gateway, possible causes include an incorrect VLAN, a down interface, an incorrect IP address or subnet mask, a failed gateway interface, a Layer 2 problem, or ICMP filtering.

Check the host's IP address, mask, interface state, and configured gateway.
Confirm that the gateway address belongs to the host's local subnet.
Check ARP for IPv4 or neighbor information for IPv6.
Verify the switch port, VLAN assignment, trunk path, and gateway interface state.
Test from the gateway toward the host to determine whether the problem is directional.

Commands such as show ip interface brief, show ipv6 interface brief, and appropriate switching verification help correlate the ICMP result with interface and Layer 2 state.

Example: Remote Destination Unreachable

If a remote IP ping returns Destination Unreachable, identify the device that generated the response. A local router may report a missing route, while a remote firewall may report an administrative prohibition.

Inspect the local routing table with show ip route or show ipv6 route.
Validate the default route, next hop, and route advertisements or static routes.
Check whether the remote network and host are operational.
Review ACLs, firewall policy, and the direction of filtering.

Example: Trace with Asterisks

Repeated asterisks can result from filtered Time Exceeded messages, control-plane rate limiting, a router configured not to respond, a return-path issue, or an actual forwarding failure. Determine whether later hops or the destination respond, test ordinary reachability separately, and review routing and filtering in both directions. Do not treat a missing traceroute response alone as definitive proof of a broken path.

Example: IPv6 Host Onboarding

If an IPv6 host does not learn an on-link prefix or default route, verify that IPv6 is enabled and that Router Solicitation and Router Advertisement messages can pass. Check router-advertisement configuration and confirm that security policy permits required ICMPv6 Neighbor Discovery messages. A successful link-local exchange may be necessary before testing a global IPv6 address.

Example: UDP Service Test

A UDP probe that receives ICMP Port Unreachable may have reached the destination host, which then reported that no UDP application is listening on the selected port. This result is different from a timeout, but it does not establish that the intended application protocol is configured correctly or that other ports are reachable.

Essential ICMP and ICMPv6 Types to Evaluate

IP version	Message type	Purpose	Risk if blocked	Policy consideration
IPv4	Echo Request and Echo Reply	Ping diagnostics.	Reachability tests may fail or appear incomplete.	Permit selectively according to management and security requirements.
IPv4	Time Exceeded	TTL expiry and traceroute feedback.	Trace output may show timeouts and loop symptoms may be harder to diagnose.	Consider controlled allowance and rate limiting.
IPv4	Destination Unreachable	Reports routing, service, policy, and MTU problems.	Applications may experience unexplained timeouts; PMTU discovery can fail.	Evaluate codes individually, including Fragmentation Needed.
IPv4	Parameter Problem	Reports an invalid or unsupported header condition.	Some interoperability failures become silent.	Allow where needed and monitor abnormal traffic.
IPv4	Redirect	Suggests a better local next hop.	Usually limited operational impact if disabled.	Restrict or disable unless explicitly required.
IPv6	Router Solicitation and Router Advertisement	Router and prefix discovery.	Hosts may not obtain normal IPv6 network information or a default route.	Permit according to the local-link security design.
IPv6	Neighbor Solicitation and Neighbor Advertisement	Address resolution, reachability, and duplicate address detection.	On-link IPv6 communication can fail.	Do not apply a blanket ICMPv6 deny.
IPv6	Packet Too Big	Path MTU Discovery.	Large transfers can stall while small tests work.	Permit valid feedback and protect against abuse with inspection or rate limits.
IPv6	Time Exceeded and Destination Unreachable	Path diagnostics and error reporting.	Tracing and error handling become less informative.	Filter by type and code rather than blocking all ICMPv6.

Less-Common and Historical Diagnostic Functions

ICMP includes or has included functions beyond the messages most administrators use daily. Timestamp messages can support time measurement, although modern time-synchronization protocols are preferred. Router Solicitation is especially important in IPv6, where it is part of Neighbor Discovery. Other message types exist for specialized or legacy purposes and may be absent, disabled, or unsupported on modern networks.

Exam-Relevant Notes

ICMP is associated with the network layer and is carried directly by IP.
IPv4 ICMP uses protocol number 1; ICMPv6 uses IPv6 next-header value 58.
ICMP does not use TCP or UDP ports.
IPv4 TTL and IPv6 Hop Limit are decremented at routed hops and prevent indefinite loops.
Traceroute uses increasing TTL or Hop Limit values and interprets Time Exceeded responses from intermediate routers.
UDP traceroute may finish with ICMP Port Unreachable, while other implementations may finish with Echo Reply or another destination response.
Ping success proves an ICMP exchange, not application-layer availability.
Ping failure may be caused by filtering or rate limiting rather than an unavailable host.
IPv6 relies on ICMPv6 for Neighbor Discovery, so blocking all ICMPv6 can break IPv6.
IPv4 Fragmentation Needed and IPv6 Packet Too Big are important to Path MTU Discovery.
A silent drop and an explicit Destination Unreachable response are different observations.
Always correlate ping and traceroute with interface status, addressing, subnet masks, default routes, routing tables, ACLs, and firewall policies.

Summary

ICMP communicates IP control information rather than normal application data. Its Type and Code fields identify errors and diagnostic functions, while the surrounding IPv4 or IPv6 packet supplies addressing and delivery context. Destination Unreachable, Time Exceeded, Parameter Problem, Redirect, Echo, and MTU-related messages explain different network conditions.

Ping uses Echo Request and Echo Reply to test a specific IP exchange. Traceroute uses deliberately expiring TTL or Hop Limit values to reveal intermediate hops. ICMPv6 extends these ideas with Neighbor Discovery and Packet Too Big messages that are essential to normal IPv6 operation. Effective troubleshooting combines ICMP evidence with routing, interface, Layer 2, ACL, firewall, and application checks rather than treating any single response as conclusive.