One, the introduction

What is ICMP? ICMP is the Internal Control Message Protocol. It belongs to the network layer of TCP/IP model like IP, and ICMP packets are wrapped in IP packets. His role is to report some network transmission errors and do some synchronization work. There are many types of ICMP packets. Only the first four bytes of each packet are in the same field, and the remaining fields vary by packet type. The ICMP packet format is as follows:

  • Type field: Indicates the type (large category) of the packet. The length is 1 byte.
  • Code field: indicates which subclass the packet belongs to. The length is 1 byte. The type field and the code field determine the ICMP packet type and subsequent field meanings.
  • Checksum: indicates the checksum of the packet. The length is 2 bytes. The checksum overrides the entire ICMP packet.

ICMP packet type

ICMP packets use type fields and code fields to determine the packet type. The following lists the corresponding types:

  • The last two columns indicate whether the packet is a query ICMP packet or an error packet. It is generally necessary to do some special processing for errant packets.
  • There are times when ICMP error packets are not generated:
    • ICMP error packets (ICMP query packets may generate ICMP error packets)
    • IP packet whose destination address is broadcast/multicast
    • Packets (such as ARP) broadcast at the link layer
    • The first non-IP fragment
    • The source address is not a unicast address.

These rules are designed to prevent the broadcast storm caused by the broadcast packet response allowed by ipc error packets.

Common ICMP packets

This section describes three common ICMP packets: ICMP port unreachable errors and ICMP address request and reply. The first is ICMP error packet. The second is ICMP query packets. Typically, query packets come in pairs (request and reply).

1. An ICMP port or host unreachable error occurs

  • Type: 3
  • Code: 1, the host is unreachable
  • Verification code: 0x4E45
  • Unused fields: 4 bytes filled with 0.
  • The IP header
  • Transport layer header

2. ICMP address mask request and reply

  • This packet is usually used to obtain its own subnet mask in diskless systems.
  • The system broadcasts its ICMP request packet (similar to obtaining an IP address via RARP).
  • The identifier and sequence number fields in the packet are optionally set by the sender and are returned in the reply. In this way, the sender can match the reply to the request.

See here, do you want to scan the QR code to follow the wechat public account Linwan Village Dragon cat.