ICMP

ICMP runs directly on IP. Echo request/reply is ping; destination unreachable says a network, host or port cannot be reached (and, with fragmentation needed, that a packet is too big); time exceeded says the TTL ran out. Blocking all ICMP breaks path MTU discovery and makes failures silent.

How ICMP works, step by step

ICMP (RFC 792 for IPv4) is IP protocol 1. It has no ports. Each message starts with a type, a code and a checksum. Error messages then carry a copy of the IP header and at least the first 8 bytes of the packet that failed; Linux sends as much as fits in 576 bytes (RFC 1812). Take a laptop at 10.0.1.10 behind an office router at 10.0.1.2, with a file server at 10.0.2.10 on the router's other side:

1. The laptop sends a packet. A ping is an echo request (type 8). The file server answers with an echo reply (type 0), copying the request's id and seq so ping can match and time each answer.
2. A router cannot forward it. It has no route: net unreachable (type 3, code 0). It has the network on a card but nobody answers ARP for the address after about 3 seconds: host unreachable (3/1). A firewall rule rejects it: administratively prohibited (3/13). The packet says Don't Fragment and is too big for the next link: fragmentation needed (3/4), with the next link's MTU in the message.
3. The TTL reaches zero. The router drops the packet and sends time exceeded (type 11, code 0). Traceroute is built on this.
4. The destination itself cannot deliver. No program listens on the UDP port: port unreachable (3/3), sent by the host. TCP answers a closed port with a reset instead.
5. The sender's kernel reads the copy inside the error, finds the socket it belongs to and reports the error to that program.

The source address of the error says how far the packet got. Redirect (type 5) is not an error: a router tells a host that another router on the same network is a better next hop. Routers limit how fast they send errors; Linux allows about one per second per destination after a short burst (net.ipv4.icmp_ratelimit, 1000 ms). IPv6 uses ICMPv6 (RFC 4443) for the same jobs, plus neighbour discovery.

What it looks like on a Linux machine

In the ICMP messages lab the laptop causes each message on purpose while tcpdump records its card. ping prints who answered and what they said:

$ ping -c1 -W2 10.9.9.9
From 10.0.1.2 icmp_seq=1 Destination Net Unreachable
$ ping -c1 -W2 -t1 10.0.2.10
From 10.0.1.2 icmp_seq=1 Time to live exceeded

tcpdump -nn -v icmp shows the error and, indented under it, the start of the packet it is about:

IP (tos 0xc0, ttl 64, id 24465, offset 0, flags [none], proto ICMP (1), length 112)
    10.0.1.2 > 10.0.1.10: ICMP net 10.9.9.9 unreachable, length 92
	IP (tos 0x0, ttl 64, id 33484, offset 0, flags [DF], proto ICMP (1), length 84)
    10.0.1.10 > 10.9.9.9: ICMP echo request, id 50, seq 1, length 64

A UDP datagram to a closed port is answered by the server itself, with the original ports inside:

    10.0.2.10 > 10.0.1.10: ICMP 10.0.2.10 udp port 9999 unreachable, length 36
    10.0.1.10.40000 > 10.0.2.10.9999: UDP, length 0

A firewall that rejects with --reject-with icmp-admin-prohibited shows up in ping as Packet filtered, and in tcpdump as ICMP host 10.0.2.10 unreachable - admin prohibited filter. A redirect reads Redirect Host(New nexthop: 10.0.1.3). A Linux host ignores redirects while it forwards packets itself, which is why the lab's laptop keeps via 10.0.1.2 in ip route get.

What goes wrong, and how you see it

All ICMP blocked. Ping fails, but worse, so does path MTU discovery: routers can no longer say "too big", and large TCP transfers hang while small ones work. The MTU and fragmentation lab builds that black hole. Block echo if you must, never type 3.

All ICMPv6 blocked. IPv6 stops entirely, because neighbour discovery is ICMPv6. In the IPv6 dual stack lab the router's entry stays INCOMPLETE and curl ends in Connection timed out, while the same rule for IPv4 changes nothing.

Silence instead of an error. A firewall that drops rather than rejects, or a router that rate-limits errors, leaves the sender waiting for a timeout. Traceroute prints * for such hops; it does not mean the hop is down.

The wrong blame. From 10.0.1.10 ... Destination Host Unreachable comes from your own machine: it never got an ARP answer for the next hop, so the packet never left. Read the source before the message.

Forged errors. ICMP is not authenticated. Linux checks that an error quotes a connection it knows, but redirects can still steer a host; many networks set net.ipv4.conf.all.accept_redirects=0.

Questions people ask

What layer is ICMP? Layer 3. It is carried inside IP, but it is part of IP's own machinery, not a transport like TCP or UDP. That is also why ICMP has no port numbers.

Is it safe to block ICMP? Blocking echo requests from outside is common and mostly harmless. Blocking destination unreachable and time exceeded breaks path MTU discovery and traceroute, and blocking ICMPv6 breaks IPv6.

Why does ping work but the website does not? Ping only proves layer 3 both ways. The service may be down, a firewall may pass ICMP but not TCP 443, or large packets may be lost: the home network lab and the TTL and traceroute pages show how to go further.

See it on real machines