ICMP is used to report errors and other information regarding IP packet processing back to the source. ICMP, which is documented in RFC 792, is best known for its use by the "ping" and "traceroute" programs on IP-enabled hosts, or devices. The ping utility sends ICMP echo request packets out to a destination host to test the IP connectivity to that destination host. Receiving an ICMP echo reply message indicates that the host can be successfully reached. As a security analyst, it is important to understand ICMP. For example, in ICMP echo request packets, one should not expect to see a large data payload. Echo replies should also be paired with echo requests. If you see many ICMP echo request and reply packets with large payloads, or if you see an imbalance in echo request and echo reply numbers, you should suspect that something suspicious may be happening. An attacker may be tunneling data out using ICMP. ICMP tunneling is possible because RFC 792, which documents IETF's rules governing ICMP packets, allows for an arbitrary data length for any type 8 (echo request), or type 0 (echo reply) ICMP packets. In addition to echo request and echo reply, ICMP has several kinds of useful messages, including destination unreachable, redirect, time exceeded, and so on. Two reasons exist for why a destination might be unreachable. Most commonly, the source host has specified a nonexistent address. Less frequently, the router does not have a route to the destination. Destination-unreachable messages include four basic types: network-unreachable, host-unreachable, protocol-unreachable, and port-unreachable. Network-unreachable messages usually mean that a failure has occurred in the routing or addressing of a packet. Host-unreachable messages usually indicate that the packet has been correctly routed to the destination network, but the destination is not active on that network. Protocol-unreachable messages generally mean that the destination does not support the transport-layer protocol that is specified in the packet. Port-unreachable messages imply that the destination is not listening on the specified TCP or UDP port. An ICMP redirect message is sent by the router to the source host to stimulate more efficient routing if another router with a better path exists on the local subnet. The router still forwards the original packet to the destination. An ICMP time-exceeded message is sent by the router if an IP packet’s TTL field reaches zero. The TTL field prevents packets from continuously circulating the internetwork if the internetwork contains a routing loop. The router then discards the original packet. ICMP uses IP protocol number 1. ICMP messages are identified by the type field. Many of these ICMP types also use a code field to indicate different conditions. The table below shows a few of the common ICMP messages.

• published: 05 Apr 2017
• views: 4443