VMware ESXi and vSphere Cluster Management

Internet Control Message Protocol (ICMP)

Learn how ICMP reports IP delivery errors, how ping uses Echo Request and Echo Reply, and how traceroute helps diagnose network paths.

Internet Control Message Protocol (ICMP) is an IP-layer protocol used to report network errors and provide diagnostic or operational information about IP packet handling. Network devices use ICMP to tell a source host that delivery failed, while tools such as ping and traceroute use ICMP-related messages to test and investigate connectivity.

ICMP is a control and reporting protocol, not an application-data transport protocol. It does not carry web pages, email, or other application content. Instead, it supports the operation and troubleshooting of IP networks.

Review this ICMP lesson from the beginning if you need a complete overview of the protocol and its diagnostic uses.

What Is ICMP?

The Internet Control Message Protocol communicates information associated with the delivery and processing of IP packets. A router or other network device may generate an ICMP message when it cannot forward a packet, cannot deliver it to the requested destination, or needs to report a condition affecting IP communication.

Important terms:

• IP datagram: an IP packet. An IP datagram can carry an ICMP message as its payload.
• Reachability: the ability of a host or network device to communicate with a specified destination across the network.
• Router: a device that forwards IP packets between networks and may generate ICMP errors when forwarding fails.

ICMP supports IP; it does not replace IP. The IP header provides the source and destination addressing and carries the ICMP message to its destination.

ICMP Encapsulation

An ICMP message is carried inside an IP datagram. This relationship can be viewed as nested protocol data:

IP datagram
└── IP payload: ICMP message
    ├── ICMP Type
    ├── ICMP Code
    └── Message-specific information

The ICMP message identifies the kind of report being sent, such as an Echo Request, Echo Reply, or Destination Unreachable message. The surrounding IP datagram provides the network-layer delivery mechanism.

For an error message, the receiving host can use the information in the ICMP message to associate the error with traffic it originally sent. In practice, an ICMP error also includes information from the packet that caused the error, allowing the source to identify the affected communication.

Why Devices Generate ICMP Errors

IP forwarding can fail for several reasons. A router may have no usable route, an outgoing interface may be down, or the destination or requested service may be unavailable. Rather than silently discarding every packet, a device can send an ICMP error back to the original source host.

The source host can then learn that the intended delivery failed and may report the condition to an application or administrator. The ICMP message is feedback about IP processing; it is not a guarantee that the network will always be able to report every failure.

ICMP Destination Unreachable

ICMP Destination Unreachable reports that a packet cannot be delivered to its intended destination or required service. The device generating the message may be a router along the path or, in some cases, the destination host itself.

Possible causes include an unavailable destination network, an unreachable host, a failed forwarding path, or an unavailable service. The exact interpretation depends on the message details and the network conditions.

Ping and ICMP Echo Messages

Ping is a diagnostic utility that tests whether a destination responds to ICMP echo traffic. It normally sends an ICMP Echo Request and waits for an ICMP Echo Reply.

Echo Request and Echo Reply Exchange

1. Host A runs ping for the server's IP address or hostname.
2. Host A places an ICMP Echo Request inside an IP datagram and sends it toward the server.
3. If the server is reachable and permits this traffic, it receives the request.
4. The server returns an ICMP Echo Reply, also carried inside an IP datagram.
5. Host A receives the reply and records the successful response, often including timing information.

An Echo Reply indicates successful response to this ICMP test. It does not prove that every application or service on the server is working. A web service, database, or other higher-layer service could still be stopped or blocked.

ping <destination-ip-or-hostname>

For example:

ping 192.0.2.20

Command syntax and displayed output vary by operating system and network-device platform.

What Does a Missing Reply Mean?

No Echo Reply means that Host A did not receive the expected response. Possible explanations include:

• the destination host is powered off or unavailable;
• a local interface, link, or default-gateway problem exists;
• routing is incorrect or a route is missing;
• a router or link along the path is failing;
• the destination is configured not to answer ICMP;
• a firewall or access-control list is filtering ICMP; or
• the request or reply was lost or timed out.

Therefore, a failed ping is not absolute proof that the destination is offline. ICMP may be blocked, disabled, filtered, or rate-limited even when other traffic works.

Common ICMP Uses

Traceroute and ICMP

Traceroute is a diagnostic utility used to examine the path toward a destination. It sends probes designed to expose successive forwarding hops. Routers may return ICMP-related responses as the probe's lifetime or hop limit is reached, and the destination may return a final response according to the implementation.

At a high level, traceroute helps answer two questions:

• Which routers respond along the route?
• At which point does forwarding or diagnostic response stop?

Command names and probe methods vary. Unix-like systems commonly provide traceroute, while Windows commonly provides tracert.

traceroute <destination-ip-or-hostname>
tracert <destination-ip-or-hostname>

If traceroute stops after an intermediate hop, do not automatically conclude that this hop is faulty. The device may filter or rate-limit diagnostic responses while still forwarding traffic. Investigate routing, interfaces, links, and security policies around the last responding point.

Destination Unreachable Scenario

Consider this routed topology:

Host A ─── R1 ─── Host B
             \
              Interface toward Host B: down

1. Host A sends an IP packet intended for Host B.
2. Host A forwards the packet to router R1, using R1 as the next hop or default gateway.
3. R1 determines that the packet must leave through its interface toward Host B.
4. That interface is down, so R1 cannot forward the original IP packet on the required path.
5. R1 generates an ICMP Destination Unreachable message.
6. R1 sends the ICMP error back to Host A, the original source.
7. Host A learns that Host B cannot currently be reached through that path.

The error does not mean that Host B can never be reached by any route. It reports that delivery failed from R1 under the current forwarding conditions. An administrator should check the interface state, physical or logical link, route, and destination network.

Interpreting Ping Results

Using ICMP in Troubleshooting

A Practical Troubleshooting Sequence

1. Start with local configuration. Verify the host's IP address, subnet information, interface state, and default gateway.
2. Test a nearby device. Ping the local gateway or another known device to distinguish local problems from remote-path problems.
3. Test the remote address. Use ping to determine whether the target responds to ICMP Echo Requests.
4. Use traceroute or tracert. If the target does not respond, examine the path and identify where responses or forwarding appear to stop.
5. Inspect network devices. Check interface and link status, routes, next hops, and relevant logs.
6. Check security controls. Review firewalls and access-control lists that may block, filter, or rate-limit ICMP.
7. Test the actual service. If ping succeeds but the application fails, investigate the service, port, name resolution, and application-layer controls.

Common Symptoms and Next Steps

• Ping receives Echo Replies: the destination or an intervening device responds to ICMP echo traffic. Verify the actual application if that is the problem.
• Ping receives no reply: check local addressing and the default gateway, interface and link status, routing, and ICMP filtering.
• A Destination Unreachable message is returned: identify the device that generated it, then inspect the relevant outgoing interface, link state, route, and destination network.
• Traceroute stops at an intermediate point: investigate routing and interfaces around the last responding hop, while accounting for filtering and rate limiting.

Exam-Ready Summary

• ICMP is an IP network-layer control and reporting protocol.
• ICMP messages are carried inside IP datagrams.
• ICMP reports errors and operational information related to IP packet handling; it does not transport application data.
• Destination Unreachable tells the original source that a packet or requested service could not be delivered.
• ping uses ICMP Echo Request and Echo Reply messages to test reachability.
• A missing ping reply can result from an unavailable host, a broken path, incorrect routing, or ICMP filtering.
• traceroute or tracert helps reveal the path toward a destination and where diagnostic responses or forwarding stop.
• A successful ping does not prove that every higher-layer service is available.