Networking

ICMP

IP's own page mentions ICMP twice — as the "Time Exceeded" message behind traceroute, and as the "one honesty signal" IP provides when something goes wrong. This page is ICMP itself: the protocol every ping command actually uses, and the closest thing IP has to its own error-reporting channel.

Quick reference

What it is: A diagnostic and error-reporting protocol that rides directly on IP — not a transport protocol, not something an application connects to.
Mental model: The postal system's own "return to sender" slips — not part of what you mailed, but the network's way of telling you something about the delivery itself.
Key numbers: No port numbers at all — ICMP identifies message types directly (Echo Request/Reply, Destination Unreachable, Time Exceeded).
Reach for it when: Diagnosing reachability and path problems (ping, traceroute) — never as a transport for application data.

Not a transport protocol

ICMP sits at the same level as TCP and UDP — directly on top of IP — but it isn't a third option for applications to send data over. It has no ports, no connections, no application payload in the usual sense; its messages are short, fixed-purpose reports about the network itself, generated by routers and hosts, not by application code.

Ping — Echo Request and Echo Reply

ping is ICMP end to end: the sender transmits an Echo Request, and if the destination is reachable and willing to respond, it sends back an Echo Reply — the round-trip time between the two is exactly what a ping command reports.

Nothing more than this exchange — no port, no connection, no data payload beyond a small pattern used to detect corruption.

Traceroute — reusing Time Exceeded

IP's own TTL section already describes this mechanism: traceroute sends packets with TTL set to 1, then 2, then 3, deliberately causing each successive router along the path to drop the packet and send back an ICMP Time Exceeded message. Each reply's source address reveals one more hop on the way to the destination — traceroute is really just a clever, repeated abuse of a TTL side effect, not a protocol of its own.

Other message types

Destination Unreachable: Sent back when a router or host can't deliver a packet at all — with sub-codes distinguishing "no route," "port unreachable," and similar specific reasons.
Time Exceeded: TTL hit zero — see traceroute above.
Redirect: A router telling a host "there's a more direct route for this — use this gateway instead next time."

Real-world applications

Uptime/health monitoring — automated systems ping devices on a schedule as the cheapest possible "is it alive" check, embedded fleets included.
Path troubleshooting — traceroute is often the very first tool reached for when traffic to a destination seems to stall partway, to see exactly which hop is the problem.
Path MTU Discovery — relies on ICMP "fragmentation needed" messages to let a sender learn the largest packet size a path can carry without fragmentation — referenced on IP's own gotchas.

Gotchas

Field notes

A device that doesn't respond to ping isn't necessarily down — many firewalls and hosts deliberately block or rate-limit ICMP Echo Requests as a matter of policy, a completely separate decision from whether the device or its actual services are reachable.
Routers are free to rate-limit or deprioritize ICMP traffic under load — a slow or missing traceroute hop doesn't always mean that router is struggling; it may just be treating ICMP as low priority by design.
ICMP itself carries no authentication — a spoofed ICMP Redirect or Destination Unreachable message is a real, if now largely mitigated, historical attack technique.