ICMP

What is ICMP?

ICMP (Internet Control Message Protocol) is the companion protocol of IP that routers and hosts use to send error messages, status information and diagnostic messages about the delivery of IP packets back to the sender. ICMP reports, for example, that a destination is unreachable, that a packet is too large or that a packet’s time to live (TTL) has expired. The well-known tools ping and traceroute are built on it. ICMP was specified in RFC 792 in 1981; IPv6 has its successor, ICMPv6 (RFC 4443, 2006).

🧠 How does ICMP work?

ICMP belongs to the network layer (layer 3) of the OSI model, but is itself carried inside an IP packet: the IPv4 header carries protocol number 1, IPv6 uses Next Header value 58. Unlike TCP and UDP, ICMP has no ports and carries no user data. It is a signalling channel of the network itself.

Every ICMP message starts with an 8-byte header:

• Type - the kind of message, for example 8 for an echo request
• Code - the precise reason within that type, for example “port unreachable”
• Checksum - detects corruption of the message
• Rest of header - depends on the type, such as an identifier and sequence number for ping

An error message always contains the IP header and the first bytes of the packet that caused the problem. This lets the sender identify which connection is affected. Hosts and routers never send an ICMP error about an ICMP error, which prevents endless chains of messages.

🔧 Which ICMP types matter most?

Obsolete types such as Source Quench (type 4) and Address Mask Request (type 17) have been formally deprecated, in RFC 6633 (2012) and RFC 6918 (2013). If you see them on your network, it often points to old equipment or reconnaissance.

🔄 How do ping and traceroute use ICMP?

Ping sends an Echo Request and measures how long it takes for the Echo Reply to return. In one go you see reachability, round-trip latency, packet loss and variation in delay (jitter). Windows sends four requests with 32 bytes of data by default; Linux pings continuously with 56 bytes of data.

Traceroute maps the path to a destination by sending packets with an increasing TTL: 1, 2, 3 and so on. Each router that sees the TTL reach zero sends back an ICMP Time Exceeded and thereby reveals its address. Windows tracert uses Echo Requests for this; classic Unix traceroute sends UDP packets to high ports (from 33434) and recognises the end point by the ICMP “Port Unreachable” reply. The same TTL counter also protects the network against routing loops: a packet that keeps circling is discarded once its TTL reaches zero, and the resulting Time Exceeded messages make such a loop visible.

🔐 What are the security risks of ICMP?

ICMP is useful for administrators, but also for attackers:

• Reconnaissance - a ping sweep across a subnet shows which IP addresses are live. Time Exceeded messages reveal the router structure, Timestamp replies the system time.
• DDoS attacks - a ping flood swamps a target with echo requests. In a Smurf attack, pings with a spoofed source address are sent to a broadcast address, after which every host answers the victim. Since RFC 2644 (1999), routers block forwarding of such directed broadcasts by default.
• Malformed packets - the historic “ping of death” sent fragmented packets that together exceeded the maximum of 65,535 bytes and crashed systems.
• Tunnelling and command and control - data hidden in the data field of echo packets. MITRE ATT&CK describes this under T1095 (Non-Application Layer Protocol).
• Redirect abuse - spoofed type 5 messages can route a host’s traffic through an attacker’s system.

Blocking ICMP entirely is not the answer, however. Without “fragmentation needed” messages, Path MTU Discovery (RFC 1191) breaks and connections hang, especially across VPN tunnels. For IPv6, RFC 4890 (2007) lists the ICMPv6 messages a firewall must never drop, and RFC 4443 requires IPv6 devices to rate-limit the error messages they originate.

🏭 Why does ICMP need extra attention in OT networks?

In an OT network, ICMP is often the simplest way to check whether a PLC, HMI or switch is still alive. Many SCADA and monitoring systems ping their devices periodically as a heartbeat. At the same time, older controllers have a limited network stack that copes poorly with unusual traffic.

There are documented incidents in which a ping sweep disrupted production: in 1998 a nine-foot robotic arm moved unexpectedly after a sweep hit its network, and in a chip fabrication plant a sweep caused the process control system to hang, destroying 50,000 dollars’ worth of wafers. This is why NIST SP 800-82 advises caution with active scanning in production environments. For asset discovery in OT, passive monitoring is preferred.

An unexpected ping sweep from an engineering workstation or from the office network is also a strong signal in OT. It is often one of an attacker’s first steps after gaining a foothold, ahead of lateral movement. An OT IDS or network monitoring with a baseline of normal traffic can detect such anomalies.

🧭 How do you set up an ICMP policy for IT and OT?

1. Inventory the use - which systems ping each other (monitoring, SNMP tools, SCADA heartbeats) and which ICMP types are really needed? A capture with Wireshark quickly gives you a picture.
2. Filter by type, not all or nothing - allow Destination Unreachable (especially code 4) and Time Exceeded; block Redirect, Timestamp and the deprecated types.
3. Restrict echo per zone - allow ping only from management and monitoring systems to the zones they supervise. This fits the zones and conduits model of IEC 62443 and network segmentation along the Purdue model.
4. Do not let ICMP pass through the DMZ - echo from the internet or the office network should not reach the control zones. Let such traffic end in the DMZ at the latest.
5. Apply rate limiting - on routers and firewalls, so a flood never reaches the controllers. For IPv6, choose a policy based on RFC 4890.
6. Disable redirects - on hosts and routers in OT segments. This is part of standard hardening.
7. Document and verify - include the ICMP rules in firewall rule management and have monitoring alert on sweeps and unusual packet sizes.

For organisations covered by the Dutch Cybersecurity Act, such a documented and tested filtering policy is part of demonstrable network security.

❓ Frequently asked questions

Is ping the same as ICMP?

No, ping is a program and ICMP is the protocol it uses. Ping sends ICMP Echo Request messages (type 8) and waits for Echo Reply messages (type 0). ICMP also has many other messages, such as error reports about unreachable destinations.

Does ICMP use TCP or UDP?

ICMP uses neither TCP nor UDP and therefore has no port numbers. ICMP messages sit directly inside an IP packet with protocol number 1 (IPv4) or Next Header 58 (IPv6). Firewall rules for ICMP therefore filter on type and code instead of port.

Should you block ICMP on a firewall?

Blocking ICMP entirely is not recommended, because it stops error messages the network needs, such as “fragmentation needed” for Path MTU Discovery. A good ICMP policy lets essential error messages through, limits echo traffic to management systems and blocks risky types such as Redirect and Timestamp. With IPv6, blocking all ICMPv6 makes the network unusable.

Why does a device not answer ping while it is working?

A device can be reachable for applications and still not answer ping, because a network firewall or its host firewall blocks ICMP Echo. Windows Defender Firewall, for example, does not allow inbound echo requests by default. In that case, test with a connection to the application port itself.

What is the difference between ICMP and ICMPv6?

ICMP belongs to IPv4 and is described in RFC 792, while ICMPv6 belongs to IPv6 and is described in RFC 4443. ICMPv6 does more: it also handles Neighbor Discovery, the IPv6 replacement for ARP. That makes ICMPv6 indispensable for a working IPv6 network.

Is ping safe on an OT network?

A single ping from a monitoring system is normal on an OT network and usually safe. Large ping sweeps or floods can, however, disrupt older PLCs and controllers, and this has happened in practice. Allow ICMP in OT only from known management systems and limit its volume.

📌 In summary

ICMP is the signalling protocol of IP that provides error reporting and diagnostics, the foundation of ping, traceroute and Path MTU Discovery. It is indispensable for operations and for IPv6, but also usable for reconnaissance, floods and tunnelling. In both IT and OT networks, filter it by type and by zone rather than blocking it entirely, limit its volume and keep active ICMP scans away from sensitive controllers.