- [Instructor] The Internet Control Messaging Protocol
is the mother of all troubleshooting protocols.
It's also heavily relied upon for message delivery
in instances where a router
needs to inform a host of dropped traffic
or service adjustments that need to be made.
It's assigned protocol number one
which should be some indication of its importance.
It's part of the IP suite like TCP and UDP,
but ICMP isn't designed to carry end-user information.
The ICMP packet header has a few interesting fields,
namely the type and code.
The type portion will designate
what the ICMP packet's purpose is,
be it destination unreachable, redirect,
echo request, echo reply, and so on.
The code then acts as a sub-selection
that gives a more finite description of the cause.
Say for example, a type 3 means destination unreachable.
With the addition of a code of 6,
the error becomes destination network unknown.
ICMP can also send redirects.
If a packet arrives on a router's interface
and it has a preferred alternate gateway
on that same subnet,
it can send a redirect ICMP message back to the sender,
informing them of the alternate gateway.
Due to security concerns,
most routers have the ability to ignore redirect messages.
These can be used by a malicious user
to initiate a man-in-the-middle attack.
A time exceeded message is sent
when a packet's time to live or TTL goes to zero.
TTL is a field that is decremented by one
each time it passes through a router.
And if it reaches zero, the packet is dropped.
The TTL prevents packets
from infinitely looping between routers,
but can also be used for troubleshooting.
The traceroute utility will send a specialized ICMP packet
with a TTL of one,
so the first hop router will drop it and generate a message.
The utility will then send the same packet
with a TTL of two.
It repeats this pattern until it reaches the end host.
The majority of system monitoring packages
and standard network testing will use ICMP echo request
to verify equipment connectivity.
This is generally done via the ping application.
ICMP is used in much the same way in IPv6,
but also supplants ARP for Layer 2 address resolution.
It also provides other IPv6-specific functions
like neighbor discovery and router advertisement.
While ICMP can be filtered from your devices,
it has become the defacto troubleshooting tool
for admins everywhere,
so I implore you to keep it active and use it regularly.