ICMP: ping & traceroute
The internet’s status-and-error protocol — and the tools you already use built on it
ICMP is the internet’s messenger for status and errors. It is not used to carry your data — it is used to report about the network itself. Once you understand it, two everyday tools stop being magic: ping and traceroute.
What is ICMP?
ICMP (Internet Control Message Protocol) is a helper protocol at the internet layer. Routers and hosts use it to send status and error messages — "your packet could not be delivered", "TTL expired", "are you there?". It never carries application data.
Common ICMP messages
- Echo Request / Reply
- The "ping" — is a host alive and reachable?
- Time Exceeded
- Sent when a packet’s TTL hits 0. Powers traceroute.
- Destination Unreachable
- No route, or the port/host cannot be reached.
- Redirect
- A router suggesting a better next hop.
How ping works
ping sends an ICMP Echo Request to a target and waits for an Echo Reply. If the reply comes back, the host is alive and reachable. The time between sending and receiving is the RTT (round-trip time) — how you measure latency.
TTL hits zero → Time Exceeded
Recall that every router decrements a packet’s TTL. When TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded message back to the original sender — telling it exactly which router the packet died at. This "feature" is the whole trick behind traceroute.
Traceroute’s clever trick
traceroute deliberately abuses TTL. It sends a probe with TTL=1: the first router decrements it to 0 and replies with Time Exceeded — revealing hop 1. Then TTL=2 reveals hop 2, TTL=3 reveals hop 3, and so on. Increasing the TTL one at a time maps every router along the path.
Reading a traceroute
The output is a numbered list of hops, each with the router’s IP and the round-trip time. A sudden jump in latency, or a row of asterisks, points you to where a path is slow or broken — a genuinely useful debugging skill.
ICMP has no ports
Unlike TCP and UDP, ICMP has no port numbers — it rides directly inside an IP packet, because it is a network-layer helper rather than an app-to-app transport. That is also why firewalls treat it separately (and why some networks block ping entirely).