Knowledge Base .: Why do we ping and what is ICMP?

What is ICMP

ICMP stands for Internet Control Message Protocol. ICMP is a form of IP packet. In a nutshell, it’s how a device (e.g. workstation, routers) on the network can find out more about the network around it, and it is for devices to talk to each other about what’s happening on the network.

The most frequently used ICMP packets you’ll encounter, are the following:

Echo

This is equivalent to shouting ‘Hello Bob are you there?” and John replies “Hello Alice I’m here.”

On a workstation or a server, you can issue the command ‘ping’ to send ICMP echo messages. For example:

Microsoft Windows 2000 [Version 5.00.2195]

C:\>ping uk.knowledgebox.com

Pinging uk.knowledgebox.com [195.69.212.80] with 32 bytes of data: (this is the ‘hello are you there’ message)

Reply from 195.69.212.80: bytes=32 time<10ms TTL=62

(These are the ‘hello I’m here’ replies)

Reply from 195.69.212.80: bytes=32 time<10ms TTL=62

Ping statistics for 195.69.212.80:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\>

If the reply was like:

Request timed out.

Then we know after a long wait we still haven’t got reply, it’s safe to assume the other side is dead. Or it may simply be blocked by the firewall, in which case you will see message such as:

Destination Unreachable

Port Unreachable

Traceroute

Another case of application of ping, by setting this field called ‘Time-To-Live’ field of ICMP packets, and making every router it encounter to reply to us, we can work out the path of which the packet traverses before reaching its destination.

Why do people love and hate ICMP?

We love ICMP. Because we can roam freely on the network, knowing who’s out there. We can troubleshoot networks with ICMP, pinpoint the breakage on a network, and get the best out the available bandwidth by throttling the traffic.

We also hate ICMP, because hackers will also know what’s in here, and they’ll figure out a way to get in sooner or later. Hackers can flood and jam our network with Pings. Hackers can forge identities with ICMP packets. There isn’t anything hackers can’t do.

So the chances are, when you are visiting a network, you’ll find inside the network ICMP is allowed, whereas at the network border, ICMP will be blocked (sensible thing for a paranoid admin to do).

References

ICMP RFC:

http://www.faqs.org/rfcs/rfc792.html

Cisco – Understanding ping:

http://www.cisco.com/warp/public/63/ping_traceroute.html

Whatis ICMP definition:

http://searchnetworking.techtarget.com/sDefinition/0,,sid7_gci214012,00.html