Practical Packet Analysis

Internet Control Message Protocol

icmp.pcap

Internet Control Message Protocol (ICMP) is a part of the IP protocol; I like to call it a utility protocol because it's used for troubleshooting other protocols. If you have ever used the ping utility, you have used the ICMP protocol.

Let's see what common ICMP traffic looks like. The included capture file only contains eight packets. There are two separate pings to two separate hosts. Let's look at the packet details of packet 1, shown in Figure 6-31.

If you expand the ICMP section, you will see what little there is to an ICMP packet. The first packet is labeled as type 8, an echo (ping) request. Every ICMP packet has a numerical type associated with it, which determines how the packet is to be handled ...