ICMP and Path Diagnostics

Updated

September 4, 2026

ICMP and Path Diagnostics

ICMP (and ICMPv6) signal errors and support diagnostics. ping and traceroute are applications of those messages—not separate magic protocols.

Learning goals

  • Map common ICMP types to meaning
  • Use ping/traceroute with clear interpretation limits
  • Understand TTL expiry and “why traceroute hops appear”
  • Preview Path MTU Discovery

ICMPv4 types (operator set)

Type Name Typical meaning
0 / 8 Echo reply / request Ping
3 Destination unreachable No route, port unreachable, admin prohibited, …
11 Time exceeded TTL expired (traceroute hops)

Codes refine type 3 (network unreachable, host unreachable, etc.).

ICMPv6

Similar roles: echo, destination unreachable, packet too big, time exceeded, ND messages (see previous chapter).

ping -c3 192.0.2.1
ping -6 -c3 2001:db8::1

Interpreting ping

Result Possible meaning
Reply Forward path + return path + ICMP allowed
Timeout Drop, filter, wrong route, silent host
Unreachable Explicit ICMP error from some node

Ping success ≠ application success. TCP port filters can still block SSH/HTTP.

Traceroute mechanics (conceptual)

  1. Send probes with TTL=1, 2, 3, …
  2. Each hop that decrements TTL to 0 should send time exceeded
  3. Destination eventually responds (port unreachable / echo)
traceroute 192.0.2.1
# or
mtr -r -c 5 192.0.2.1

Limits: load balancers, ICMP rate limits, firewalls that hide hops, asymmetric return paths.

Path MTU Discovery (preview)

  • Senders prefer not to fragment (IPv6: no in-path fragmentation)
  • Hop returns Packet Too Big / frag-needed if DF set and MTU smaller
  • Broken PMTUD → hangs for large transfers while small pings work

Deep labs: Layer 3 ICMP & Path MTU chapter.

Filters and policy

Many networks rate-limit or block ICMP. That improves some attacks and hurts diagnostics and PMTUD. Lab hygiene: know your nftables/iptables ICMP rules.

# Example observability only—do not paste blindly into production
nft list ruleset
iptables -L -n

Lab sketch

  1. Three-node line (A—B—C)
  2. Ping A→C; traceroute A→C
  3. ACL drop ICMP on B: compare symptoms

Checkpoint

Why can ping work while curl http://… fails? Why can traceroute show * * * on middle hops while the destination still answers?

Next