Internet ControlMessageProtocol (ICMP)
TCP and UDP exist primarily to deliver upper-layer data across a network. Whether
connection oriented or connectionless, fundamentally the process of delivering the data is
the same: identify the source and destination application ports, format the data
accordingly, and deliver the data to IP. This process works well when the network is
functioning without error and when systems are operating correctly and know how to
deliver data through routers and subnets to any destination, anywhere. The problem is
that the network does not always work, routes fail, and data may not be able to be
delivered (or it may need to be directed elsewhere to be successfully delivered). To
facilitate this process, the ICMP protocol was developed.
In many ways, ICMP functions like the traffic cop and policeman of the network.
Because IP (and UDP) lack any mechanism for identifying that failures may occur on the
network, they need an external protocol that can provide information about routing
failures and to report about delivery errors, congestion delays, and other conditions on the
network. Indeed, like the traffic cop notifying motorists about congestion delays or
blocked intersections (routers) on the street, ICMP provides a means to control the flow
of traffic in an effort to ensure that the data can be reliably delivered.
An important distinction to understand about ICMP is that it is an error-reporting
mechanism, not an error-correcting mechanism. That means that although ICMP can
notify hosts of error conditions, ICMP natively has no means or method of actually doing
anything about the error condition. Instead, ICMP relies on other protocols such as
routing protocols or reliable protocols such as TCP to account for and address the
particular error condition.
The most well-known use of ICMP is through the use of the ping application. Ping is a
network troubleshooting application that makes use of ICMP echo request and echo reply
(detailed in the next section) messages to determine whether a host is responding to
network traffic. This allows the user to determine the reachability and status of the target
host in a pretty simple manner. If a target host responds, it is reachable and available. If it
does not, depending on the echo reply message, either the target host, target network, or
network somewhere between the source and destination is unreachable and unavailable.
We talk more about ping in Chapter 13
, "Troubleshooting Firewalls," and Appendix A,
"Firewall and Security Tools".
N
ote
RFC 0792 and RFC 0950 define ICMP.
ICMP Message Structure
ICMP controls the data being transmitted over the network through the use of numerous
message types. Each ICMP message type contains specific formatting related to its
function, but most implement a header and data field of varying lengths. All ICMP
messages begin with the same 32 bits of data. First, 8 bits of data known as the TYPE
field define the ICMP type. Next, 8 bits of data known as the CODE field provide
additional information specific to the message type. Then, 16 bits of data known as the
CHECKSUM ensure that the data that is delivered is the same amount of data that was
transmitted.
Some of the more common message types are as follows:
• Echo reply (Type 0) In concert with echo request (type 8), echo reply makes up
one half of the messages that are used by the ping utility for testing destination
reachability and status. As the name implies, this message is the reply to an echo
request message.
• Destination unreachable (Type 3) Destination unreachable messages are sent by
intermediate routers to inform a host that it cannot forward or deliver the data.
There are 13 codes associated with destination unreachable messages, each
representing a specific failure condition. Common codes include the following:
- Network unreachable (Code 0) This typically indicates a failure of a router.
- Host unreachable (Code 1) This typically indicates that the destination network
was reachable, but the host was unable to be contacted, and thus indicates a failure
with the destination host itself.
- Protocol unreachable (Code 2) This typically indicates that the network protocol
(for example, TCP or UDP) cannot be reached.
- Port unreachable (Code 3) Similar to protocol unreachable, this typically
indicates that the given port (for example, the TCP or UDP port of the application
in question) cannot be reached.
• Source quench (Type 4) Source quench messages are used to rate limit traffic
during periods of congestion. Routers typically reserve an amount of memory to
store data in temporarily before it is delivered. If for some reason the router cannot
efficiently deliver the data, it could run out of memory to store new data. Rather
than drop the data packets (at which point if using a connection-oriented protocol
such as TCP the data will need to be retransmitted), it will attempt to issue a
source quench message. This message tells the source router to slow down the rate
at which it is delivering the data in hope that whatever condition is causing the
router to buffer data is fixed, at which point the normal flow of data can be
reinstated and no data is lost or needs to be retransmitted.
• Redirect (Type 5) Redirect messages are used to notify hosts to update their
routing table to reflect a change in the routing environment. These are typically
issued by routers that recognize that a host is using a nonoptimum routing
configuration. A common instance of this is when a host's default gateway is on
the same network as another gateway that it must use (such as a firewall). In that
case, the router issues a redirect to inform the host to send the data to the other
gateway directly, because that would be more efficient than going through the
default gateway than the other gateway.
• Echo request (Type 8) Echo request messages make up the other half of the
messages used by the ping utility. As the name implies, an echo request message
requests that the target host respond with an echo reply message.
• Time exceeded (Type 11) Time exceeded messages are used to indicate that a
circular or excessively long route has been detected and are a means of notifying
the source host that the data was unable to be routed to the given destination.
N
ote
For a list of all ICMP message types, refer to http://www.iana.org/assignments/icmp-
parameters.
Bad ICMP
ICMP is one of the most abused protocols out there by the nature of what it exists to do.
After all, if you want to attack a network or host, what better method to do so than to use
the protocol that is designed to control network traffic in general? Consequently, a
common example of "bad" ICMP is to allow any ICMP traffic from untrusted sources
onto your trusted networks. For example, if you allow ICMP redirects, you leave your
Internet hosts susceptible to having their traffic inadvertently routed to the wrong
location. This could result in a DoS in the best case (because the traffic never makes it to
the hosts that are requesting data) or could result in a data compromise (in the event that
the data can be redirected to a host that the attacker controls). To address this, it is
generally a good idea to block ICMP traffic, in particular between trusted and untrusted
networks. The downside of this, of course, is that by blocking ICMP you also lose any of
the benefits of ICMP, such as the ability to use ping to test the reachability of remote
hosts. To mitigate this most firewalls allow you to define certain types of ICMP messages
to permit or deny, thus allowing you to allow some ICMP traffic (such as time exceeded,
destination unreachable, and echo replies) while blocking other ICMP traffic (such as
redirects).
ICMP messages themselves are also susceptible to manipulation (as occurs frequently
with the insertion of bogus or extremely large amounts of data in an ICMP message in
hopes that the target host cannot properly process the message, which may leave it in a
vulnerable state). Perhaps the most well known of this kind of manipulation is known as
the "ping of death," which transmitted a message that exceeded the 65,535-byte limit of
the IP protocol, which would cause many target hosts to crash, resulting in a DoS.
.
Internet Control Message Protocol (ICMP)
TCP and UDP exist primarily to deliver upper-layer.
ICMP Message Structure
ICMP controls the data being transmitted over the network through the use of numerous
message types. Each ICMP message type