What is ICMP? The internet's error-and-diagnostics protocol, explained

Q: Is it safe to block all ICMP at the firewall?

No, and it is a surprisingly expensive mistake. Dropping echo requests alone is reasonable — your host simply stops answering ping. Dropping ICMP as a whole also removes the messages Path MTU Discovery relies on, producing an MTU black hole where small packets work and large ones vanish. It removes Time Exceeded, so traceroute stops working. And on IPv6 it takes Neighbor Discovery with it, which stops the network working at all. Filter by type, not wholesale.

ICMP in one paragraph

ICMP stands for Internet Control Message Protocol. Its entire job is to report on the fate of other packets. When a router throws a packet away — no route to the destination, the packet has been bouncing around too long, or it is too big for the next link — ICMP is how the router tells the sender what happened. It is a companion to IP rather than a passenger on top of it: every IP implementation is expected to speak it.

The crucial point is that ICMP carries no user data. Nothing you actually want to move across the internet — a page, a file, a stream — travels inside an ICMP message. It is the control plane talking about the data plane. For how the layers fit together, the TCP/IP model is the map ICMP sits on.

ICMP is not a transport protocol — and it has no ports

TCP and UDP are transport protocols: they multiplex many conversations over one IP address using port numbers. ICMP does none of that. It is not a transport protocol, and it has no port numbers at all.

Instead of ports, every ICMP message carries a type and a code. The type says what class of message this is; the code narrows it down. That is why you can never “port forward ICMP”, and why on a firewall you permit or deny ICMP by type — allowing echo requests, say, while dropping redirects. For the port-based world by contrast, see TCP vs UDP.

The messages ICMP carries

There are many ICMP types, most of them rare. A handful account for nearly everything you will see on a real network.

Echo Request and Echo Reply

An Echo Request (type 8 in IPv4) says: “if you can hear me, say something back.” A host willing to answer sends an Echo Reply (type 0), copying back the identifier, sequence number and payload it was sent. They exist purely so one machine can ask another whether it is reachable, and they are the entire basis of ping.

Destination Unreachable

Generated when a packet cannot be delivered, with the code explaining why: no route to the network, no route to the host, port not listening, or administratively prohibited by a filter. The last is how a firewall rejects traffic politely rather than swallowing it silently — and the port-unreachable variant is quietly load-bearing for traceroute.

Time Exceeded

Every IP packet carries a TTL (Time To Live), called the hop limit in IPv6. Each router that forwards it decrements the TTL by one. If a router decrements it to zero, it must discard the packet and send a Time Exceeded message back to the source. The mechanism exists to stop packets circulating forever in a routing loop — and as a side effect it is what makes traceroute possible.

Redirect

Sent when a host on the same local network has picked a suboptimal first hop: “you sent that to me, but the better gateway for that destination is over there.” Legitimate — but also a classic primitive for steering a victim's traffic, which is why many hosts ignore them.

Fragmentation Needed / Packet Too Big

The unglamorous one that keeps the internet working. Every link has a maximum transmission unit (MTU): the largest packet it will carry. When a router gets a packet bigger than the next link's MTU and the sender set the “don't fragment” flag, it cannot chop the packet up. It drops it and sends back a “too big” message — in IPv4 the fragmentation-needed code of Destination Unreachable, in IPv6 a dedicated Packet Too Big type. Critically, that message includes the MTU of the offending link, so the sender knows what size to use instead. That feedback loop is Path MTU Discovery. Hold that thought.

How ping works

ping is a thin wrapper around ICMP echo. It sends an Echo Request with a sequence number and timestamp in the payload, starts a timer, and waits. If an Echo Reply comes back, it subtracts send time from receive time and prints the round-trip time.

That is all it is. Ping tells you whether echo replies come back, and how long they take — round-trip latency, including the target's own delay in answering. It says nothing about whether any actual service on that host is healthy. A machine can answer ping beautifully while its web server is on fire.

How traceroute exploits TTL

Traceroute is a hack built on the Time Exceeded rule. It sends a probe toward the destination with the TTL set to 1. The first router decrements it to zero, drops it, and — because the rules require it — sends back a Time Exceeded message from its own address. That reveals hop 1. Traceroute then sends a probe with TTL 2, which dies at the second router and reveals hop 2, and so on until the probes reach the destination.

Note the split: the probes going out may be ICMP echo requests, UDP datagrams or TCP SYNs, depending on the tool — but the replies that reveal each hop are almost always ICMP Time Exceeded. Without ICMP, traceroute has nothing to listen for. Full walkthrough in the traceroute guide.

ICMPv6: not optional, and not just ICMP with bigger addresses

In IPv4 you can filter most ICMP and still limp along. In IPv6 you cannot, because ICMPv6 absorbed jobs that IPv4 handed to other protocols entirely.

Neighbor Discovery. IPv4 uses ARP — a separate protocol — to map an IP address to a MAC address on the local link. IPv6 has no ARP; it uses the Neighbor Discovery Protocol, and NDP's messages (Neighbor Solicitation and Advertisement, Router Solicitation and Advertisement) are themselves ICMPv6 messages. Filter them and hosts on your own LAN cannot find each other, let alone the router. Router Advertisements also hand out the prefixes hosts use to build an IPv6 address.
Path MTU Discovery is mandatory. IPv6 routers do not fragment packets in transit — that is the sender's job. So the only way a sender learns a packet was too big for a link along the path is the ICMPv6 Packet Too Big message. Drop it and oversized packets simply vanish.

The practical rule: on IPv6, never filter ICMPv6 as a category. Filter the specific types you have a reason to filter, and let the rest through.

Why people block ICMP — and why blocking all of it is a mistake

The instinct comes from a real place. Echo requests let strangers probe which addresses in your range are live, ICMP has been abused for reflection attacks, and redirects can be forged. Choosing not to answer echo requests from the public internet is defensible.

What is not defensible is the leap to a blanket deny icmp any any. That rule also takes out the messages Path MTU Discovery depends on, and the resulting failure is one of the nastiest in networking:

Small packets pass fine, so the TCP handshake completes and all looks healthy.
Then one side sends a full-size packet that exceeds an MTU somewhere along the path. It is dropped — and the “too big” message that would have explained why is dropped too.
The sender learns nothing, retransmits the same oversized packet, and it is dropped again. The connection hangs.

This is an MTU black hole, and the symptoms are maddening: SSH connects then freezes the instant you run a command with a lot of output; a page loads its HTML and stalls on a large image; a VPN tunnel comes up and only works for tiny requests. Small things work, big things hang. The same rule kills Time Exceeded, so traceroute stops working precisely when you need it — during the outage you are trying to diagnose.

“It doesn't answer ping” does not mean it is offline

Because ICMP echo is so widely filtered, a silent ping is weak evidence. A host can fail to answer because it is genuinely down, because its own firewall drops echo requests, because a network in the middle filters them, because a router rate-limited the ICMP it was willing to generate, or because a cloud security group does not allow them. Only one of those five means the host is off. The right test is to open a TCP connection to the port the service should be listening on. If it answers, the host is up and ping was lying to you.

That rate-limiting caveat also explains a common traceroute misreading: a middle hop showing a latency spike is often just a router deprioritising the ICMP replies it generates for you, while forwarding real traffic at full speed. A spike only matters if it persists to the end of the path.

Frequently asked questions

Does ICMP use port numbers?

No. Ports belong to the transport layer — TCP and UDP — and ICMP is not a transport protocol. ICMP messages ride directly inside IP packets, and instead of a port number they carry a type and a code. That is why a firewall rule for ICMP reads “allow echo request” rather than “allow port 7”, and why port-forwarding ICMP is not a thing.

Is it safe to block all ICMP at the firewall?

No. Dropping echo requests alone is reasonable — your host simply stops answering ping. Dropping ICMP as a whole also removes the messages Path MTU Discovery relies on, producing an MTU black hole where small packets work and large ones vanish; it removes Time Exceeded, so traceroute stops working; and on IPv6 it takes Neighbor Discovery with it, which stops the network working at all.

If a host does not reply to ping, is it offline?

Not necessarily. Plenty of healthy servers, cloud instances and desktops are configured to silently drop echo requests, and plenty of networks filter them in transit. A silent ping tells you only that no echo reply came back. To find out whether a host is really up, connect to a service it should be running rather than treating ping as an availability check.

What is ICMP? (The internet's error-message protocol)