hop 19 of 32 · 5 min

The protocol that reports problems

IP forwards packets and never explains. ICMP is the companion protocol that carries the explanations, and two familiar tools are built on it.

The messages

Type	Meaning	When
Echo request and reply	are you there	ping
Destination unreachable	no route, or port closed	no path, or nothing listening
Time exceeded	TTL hit zero	a loop, or traceroute
Fragmentation needed	too big, don't fragment set	path MTU discovery
Redirect	a better route exists	suboptimal first hop

ping

code

$ ping example.com
64 bytes from 93.184.216.34: icmp_seq=1 ttl=56 time=138 ms
64 bytes from 93.184.216.34: icmp_seq=2 ttl=56 time=139 ms

Reachability and round trip time. What it does not tell you is whether the service is working: a machine can answer ping perfectly while the web server on it is down, because a different part of the kernel answers.

And the reverse: many hosts and firewalls drop ICMP entirely, so no reply does not prove the host is down. Concluding "ping fails, the server is dead" is a standard and wrong diagnosis.

traceroute

Described earlier: increasing TTL, each router identifying itself as it discards a packet.

Reading the output needs care. A hop showing high latency is not necessarily the problem, because generating an ICMP reply is low priority work for a router and may be delayed even while forwarding is fast. What matters is latency that is high and stays high for every subsequent hop.

code

 5  10.1.1.1     8 ms
 6  10.2.2.2   180 ms      <- looks alarming
 7  10.3.3.3     9 ms      <- but the path is fine

Hop 6 was slow to reply, not slow to forward. The real problems look like this:

code

 5  10.1.1.1     8 ms
 6  10.2.2.2   180 ms
 7  10.3.3.3   185 ms      <- everything after is also slow

Asymmetric routing complicates it further: the return path may differ from the outbound one, so a delay may be on a path traceroute never shows.

Why blocking all ICMP is a mistake

It is often blocked as a security measure, on the basis that it reveals information and has been used in attacks. Blocking it entirely also breaks path MTU discovery, and the symptom is the worst kind: small requests work, large ones hang, and nothing reports an error.

The defensible position is to rate limit ICMP and allow the types that make the network work, particularly fragmentation needed.