- What Is a Network?
- What Is a Packet and What Does It Look Like?
- IPv4 Versus IPv6
- How Do Packets Get Around?
- Network Address Translation
- Internet Control Message Protocol
- Ethernet
- The Internet
- Conclusion
Internet Control Message Protocol
With the vast amount of traffic being carried across networks, there needed to be some mechanism for managing the overall infrastructure and determining things such as connection status, traffic flow, and availability. To handle these tasks, the Internet Control Message Protocol (ICMP) was developed. ICMP was designed to carry error, control, and informational messages. It also provides some excellent capabilities such as determining whether a destination is reachable, testing how long it takes to get to a particular destination, discovering what route a packet might take to get to a particular destination, and telling other network systems to slow down their rate of packet transmission.
Although originally designed with good intentions, ICMP has become the most popular mechanism for executing Denial of Service (DOS) attacks, which are designed to disrupt, delay, or destroy legitimate network communications. (See Chapter 26, "Distributed Denial of Service Attack Survivability," for more information on DOS attacks). Due to the rise in both the destructiveness and popularity of ICMP-based DOS attacks, many organizations block or deny any inbound ICMP packets from external sources.
ICMP packets are sent using the same header structure as IP packets with the Protocol Field set to "1" to indicate that it is an ICMP packet. Each packet also contains a type, which indicates what type of ICMP message it is, and a code field, which tells you what the message really means. For example, an ICMP packet with a type of 3 and a code of 1 tells you this is a "Destination Unreachable" message and, more specifically, a "Host Unreachable" message, usually indicating that you are unable to communicate with the intended destination. With more and more organizations blocking ICMP, but allowing specific TCP and UDP services, these messages can no longer be relied on to provide reliable information about the status or location of a destination. Table 3.2 shows some common ICMP message types and their corresponding codes.
Table 3.2 ICMP Message Types and Codes
|
Type |
Code |
Message |
Meaning |
|
0 |
0 |
Echo Reply |
The destination machine is reachable and transmitting and receiving network traffic. |
|
3 |
0 |
Net Unreachable |
The destination network cannot be reached. |
|
3 |
1 |
Host Unreachable |
The destination system cannot be reached. |
|
3 |
2 |
Protocol Unreachable |
You cannot communicate to the destination using this protocol. |
|
3 |
3 |
Port Unreachable |
The specified destination port is not reachable. |
|
3 |
4 |
Fragmentation Needed |
You cannot communicate with your destination unless you use smaller packet sizes. |
|
3 |
5 |
Source Route Failed |
The route specified cannot reach the intended destination. |
|
4 |
0 |
Source Quench |
Please slow down, you are sending information too quickly for me to handle. |
|
5 |
0 |
Network Redirect |
To reach the destination network, use this other route. |
|
5 |
1 |
Host Redirect |
To reach the destination system, use this other route. |
|
5 |
2 |
Service and Network Redirect |
To reach a particular service on a particular network, use this route. |
|
5 |
3 |
Service and Host Redrect |
To reach a particular service on a particular system, use this route. |
|
8 |
0 |
Echo Request |
If you are my intended destination, please tell me that you are sending and receiving network traffic. |
|
11 |
0 |
Time to Live Exceeded |
The packets you sent were only valid for a certain time and they could not be delivered to the destination before that time ran out. |
|
11 |
1 |
Fragment Reassembly Exceeded |
The fragmented packets you sent could not be put back together in time. |
|
12 |
0 |
Parameter Problem |
The packet you sent had some problems in it and could not be processed. The code field points to where the error was located. |
|
13 |
0 |
Timestamp Request |
What time do you think it is? |
|
14 |
0 |
Timestamp Reply |
This is the time according to my clock. |
|
15 |
0 |
Information Request |
What network are you on and what is your IP address? |
|
16 |
0 |
Information Reply |
This is my network and IP address. |