What is ICMP, and how is it different from TCP/UDP?
ICMP is the network's "diagnostic and error-reporting" protocol — used by tools like ping and tracert, not for application data.
The role of ICMP:
ICMP doesn't carry application traffic. It carries control and diagnostic messages:
- "Destination unreachable"
- "Time exceeded" (TTL hit zero)
- "Echo request" (ping)
- "Echo reply" (pong)
- "Redirect" (use a different gateway)
Why it's a Layer 3 protocol, not Layer 4:
Even though ICMP often feels like an app protocol (you "use" ping), it operates at the network layer alongside IP, not on top of TCP/UDP. ICMP messages are encapsulated directly in IP packets:
[ Ethernet | IP | ICMP | data ]
No port numbers. No connection. No reliability.
Common ICMP types:
| Type | Name | Use |
|---|---|---|
| 0 | Echo Reply | ping response |
| 3 | Destination Unreachable | error |
| 8 | Echo Request | ping request |
| 11 | Time Exceeded | tracert |
| 30 | Traceroute | (rarely used) |
Why blocking ICMP is controversial:
Some admins block all ICMP "for security" — but this breaks PMTU discovery (causing fragmentation issues), error reporting, and basic troubleshooting. Best practice: rate-limit ICMP, don't block it entirely.
Tip: When ping returns "Request timed out," it doesn't always mean the host is dead — it might be alive but configured to ignore ICMP echo requests (common on Windows servers and many corporate firewalls).
Go deeper:
Internet Control Message Protocol (Wikipedia) — complete table of ICMP types/codes and how ping and traceroute build on them.