5. icmp
Download as PPT, PDF20 likes7,647 views
The Internet Control Message Protocol (ICMP) is used to report issues with the delivery of IP packets. It allows devices on the network to check connectivity and diagnose routing problems. ICMP messages are transmitted as IP packets and used by ping and traceroute utilities. It supports functions like announcing network errors, congestion, and assisting troubleshooting. While providing important feedback, ICMP redirect messages can potentially direct traffic to unauthorized systems if not restricted to trusted sources.
5. icmp
- 1. Internet Control Message Protocol 1
- 2. About the Internet Control Message Protocol The Internet Control Message Protocol (ICMP) protocol is classic example of a client server application. The Internet Control Message Protocol (ICMP) is part of the Internet protocol suite. The ICMP server executes on all IP end system computers and all IP intermediate systems (i.e routers). 2
- 3. Internet Control Message Protocol The protocol is used to report problems with delivery of IP datagrams within an IP network. when a particular End system is not responding, when an IP network is not reachable, when a node is overloaded, when error occurs in IP header information, etc. The protocol is also frequently used by Internet managers to verify correct operations of End Systems and to check that routers are correctly routing packets to the specified destinations. 3
- 4. Internet Control Message Protocol ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module. 4
- 5. Purpose of ICMP The Internet Control Message Protocol is a protocol • for the exchange of error messages and other vital information between Internet entities such as hosts and routers. 5
- 6. ICMP in the TCP/IP protocol suite ICMP is a network layer protocol, often it is placed next to the IP protocol. ICMP Header ICMP Data Area IP Header Frame Header IP Data Area Frame Area 6
- 7. ICMP in the TCP/IP protocol suite ICMP lies just above IP, as ICMP messages are carried inside IP Packets. ICMP messages are carried as IP payload, just as TCP/UDP segments are carried as IP payload When a host receives an IP packet with ICMP specified as the upper layer protocol, it demultiplexes the packet to ICMP, just as it would demultiplex a packet to TCP/UDP. 7
- 8. ICMP functions Announce network errors: such as a host or entire portion of the network being unreachable, due to some type of failure. Announce network congestion: When a router begins buffering too many packets, due to an inability to transmit them as fast as they are being received, it will generate ICMP Source Quench messages. Directed at the sender, these messages should cause the rate of packet transmission to be slowed. 8
- 9. ICMP functions Assist Troubleshooting: ICMP supports an Echo function, which just sends a packet on a round--trip between two hosts. Ping, a common network management tool, is based on this feature. Ping will transmit a series of packets, measuring average round-trip times and computing loss percentages. Announce Timeouts: If an IP packet's TTL field drops to zero, the router discarding the packet will often generate an ICMP packet announcing this fact. TraceRoute is a tool which maps network routes by sending packets with small TTL values and watching the ICMP timeout announcements. 9
- 10. ICMP Applications There are two simple and widely used applications which are based on ICMP: Ping Traceroute. 10
- 11. ICMP Applications PING: The ping utility checks whether a host is alive & reachable or not. This is done by sending an ICMP Echo Request packet to the host, and waiting for an ICMP Echo Reply from the host. host TRACE ROUTE: Trace route is a utility that records the route through the Internet between your computer and a specified destination computer. It also calculates and displays the amount of time each hop took. 11
- 13. ICMP datagram structure The ICMP datagram, being an IP datagram, contains the usual IP header. This is followed by an ICMP header which varies slightly between the different types of ICMP message. The general format is shown below: 13
- 14. ICMP Message Types Typ e 3 Message Type Description Destination Unreachable Packet could not be delivered 11 Time Exceeded Time to live field hit 0 12 Parameter Problem Invalid header field 4 Source Quench Choke Packet 5 Redirect Teach a router about geography 8 Echo Ask a machine if it is alive 0 Echo Reply Yes, I am alive 13 Timestamp Request Same as Echo request, but with timestamp 14 Timestamp Reply Same as Echo reply, but with timestamp 14
- 15. More about Message Types The DESTINATION UNREACHABLE message is used when the subnet or a router cannot locate the destination. The TIME EXCEEDED message is sent when a packet is dropped because its counter has reached zero. This event is symptom that packets are looping, that there is enormous congestion, or that the timer values are being set too low. The PARAMETER PROBLEM message indicates that an illegal value has been detected in a header field. This problem indicates a bug in the sending host’s IP software or possibly in the software of a router transited. The SOURCE QUENCH message was formerly used to throttle hosts that were sending too many packets. When a host received this message, it was expected to slow down. 15
- 16. More about Message Types The REDIRECT MESSAGE is used when a router notices that a packet seems to be routed wrong. It is used by the router to tell the sending host about the probable error. The ECHO and ECHO REPLY messages are used to see if a given destination is reachable and alive. Upon receiving the ECHO message, the destination is expected to send an ECHO REPLY message back. The TIMESTAMP REQUEST and TIMESTAMP REPLY messages are similar, except that the arrival time of the message and the departure time of the reply are recorded in the reply. This facility is used to measure network performance. 16
- 17. Code: The exact meaning of the value contained within this field depends on the message Type. For example, with an ICMP Type 3 message ("Destination unreachable"), a Code value of 0 means "Network unreachable", which implies a router failure. A Code of 1 means "Host unreachable". Checksum: The checksum field provides error detection for the ICMP header only calculated in the same way as the IP header checksum. and is Parameters: The usage of this field depends on the type of message. For example, Type 3 messages do not use this field, while Type 0 and 8 messages use the field to store an identifier and sequence number. Data: Typically, the data is the IP header and first 64 bits of the original datagram. Including the first 64 bits of the original datagram allows the ICMP message to be matched to the datagram that caused it. 17
- 18. Destination Unreachable Codes Code Definition 0 Net Unreachable 1 Host Unreachable 2 Protocol Unreachable 3 Port Unreachable 4 Fragmentation needed & Don’t Fragment was set 5 Source Route failed 6 Destination Network Unknown 7 Destination Host Unknown 8 Source Host Isolated 9 Communication Destination Network is Administratively Prohibited 10 Communication Destination Host is Administratively Prohibited 11 Destination Network Unreachable for Type of Service 12 Destination Host Unreachable for Type of Service 13 Communication Administratively Prohibited 14 Host Precedence Violation 15 Precedence Cutoff Violation 18
- 19. Redirect Codes Code Definition 0 Redirect Datagram for the Network (or subnet) 1 Redirect Datagram for the Host 2 Redirect Datagram for the Type of Service & Network 3 Redirect Datagram for the Type of Service & Host Time Exceeded Codes Codes Parameter Problem Code Definition Time to Live Exceeded in Transit 0 Pointer Indicates the Error Fragment Reassembly Time Exceeded 1 Missing a Required Option 2 Bad Length Code Definition 0 1 19
- 21. Problems ICMP redirect messages can be used to trick routers and hosts acting as routers into using ``false'' routes; these false routes would aid in directing traffic to an attacker's system instead of a legitimate trusted system. Older versions of UNIX could drop all connections between two hosts even if only one connection was experiencing network problems. 21
- 22. Summary 22
- 23. Summary ICMP provides vital feedback about IP routing and delivery problems ICMP is really part and parcel of IP itself. Two vital TCP/IP diagnostic utilities, known as PING and TRACEROUTE , use ICMP to measure roundtrip times between a sending and receiving host, and to perform path discovery between sender and receiver 23
- 24. Summary ICMP also supports route optimization through its ICMP Redirect message type, but this capability is normally restricted only to trusted sources of information 24
- 25. Questions 1.Why Source Quench message is rarely used? Sol: When Congestion occurs, sending these packets increases the congestion. 2.When are ICMP Messages generated? Sol: ICMP messages are typically generated in response to errors in IP Datagrams or for diagnostic or routing purposes. 3.What is the drawback of using the ping command? Sol: The ping command will send an ECHO_REQUEST datagram to a host or network interface. On reception, the packet is returned with an ECHO_RESPONSE datagram. While this test does not verify that your server is operating correctly, it does verify that the networking portion of it is reachable. 25