Questions: ICMP: Internet Control Message Protocol

Question 1

How does traceroute reconstruct the path a packet takes through the network?

• A. It sends successive packets with TTL values of 1, 2, 3, ... and collects the Time Exceeded ICMP replies from each router that drops a packet
• B. It sends Echo Request packets to each router and measures which ones reply
• C. It reads the routing tables from each router along the path using SNMP
• D. It sends a packet with the Record Route IP option, which causes each router to add its address to the packet header

Answer: (A)

Traceroute exploits the TTL (Time to Live) mechanism. A router that receives a packet with TTL=0 discards it and sends back an ICMP Time Exceeded message (type 11) — which reveals the router's IP address. By incrementing TTL from 1 upward, traceroute triggers one Time Exceeded per hop, mapping the path. This is a clever indirect use of an error-reporting mechanism.

Question 2

A network administrator completely blocks all ICMP traffic at the corporate firewall for security reasons. Which legitimate network function is most likely to break as a result?

• A. Path MTU Discovery, which relies on ICMP 'Fragmentation Needed' messages to negotiate packet sizes
• B. DNS resolution, because DNS uses ICMP for error reporting when a name server is unreachable
• C. TCP connection establishment, because SYN packets use ICMP for acknowledgment
• D. DHCP lease renewal, because DHCP uses ICMP Echo to check address conflicts

Answer: (A)

Path MTU Discovery works by sending large packets and relying on routers to return ICMP 'Destination Unreachable — Fragmentation Needed' (type 3, code 4) when a packet exceeds a link's MTU. If all ICMP is blocked, these messages never arrive and connections stall with mysteriously dropped large packets. DNS, TCP SYN, and DHCP do not depend on ICMP.

Question 3

ICMP messages are encapsulated inside IP packets and travel over the same network infrastructure as regular data, even though they are used for control and error reporting rather than application data.

• T. True
• F. False

Answer: True

True. ICMP is assigned IP protocol number 1 and is carried inside IP packets exactly like TCP (protocol 6) or UDP (protocol 17). It is part of the network layer but uses IP as its transport. This is why ICMP error messages can traverse multiple router hops to reach the original sender — they are routed just like any other IP traffic.

Question 4

Blocking most ICMP traffic at a firewall is a best security practice because ICMP serves no legitimate purpose in a properly configured network.

• T. True
• F. False

Answer: False

False. While ICMP can be abused (ping sweeps, smurf attacks, network mapping), it also enables essential network functions: Path MTU Discovery, error reporting for misconfigured routes, and basic reachability testing. The correct approach is selective filtering — block dangerous types (like Redirects from external sources) while allowing Echo Request/Reply and Destination Unreachable messages. Blocking everything breaks legitimate operations.

Question 5

Explain how traceroute uses ICMP to map network paths — what mechanism does it exploit, and why does that mechanism reveal intermediate routers?

Model answer: Traceroute exploits the TTL (Time to Live) field in IP headers. Every router decrements TTL by 1 and discards any packet whose TTL reaches zero, then sends an ICMP Time Exceeded message back to the sender. By sending packets with TTL=1 first, then TTL=2, then TTL=3, etc., traceroute ensures each successive packet is dropped one hop further along the path. Each Time Exceeded reply comes from the router that dropped it, revealing that router's address. Collecting these replies reconstructs the full path hop by hop.

The TTL mechanism was designed to prevent routing loops from circulating packets forever — it's a safety valve, not a path-discovery tool. Traceroute repurposes this error condition cleverly: by controlling where in the network a packet expires, it turns each router's error report into a path-mapping signal. The key insight is that ICMP Time Exceeded messages must identify the sender (the router), so each triggered error reveals exactly which router is at that hop.