ICMP // RFC 792

Every ICMPv4 message starts with Type, Code and a 16-bit Checksum. The next four bytes are the rest of header: their meaning is fixed by the type and code, not by the common header. Everything after byte eight is the message body. The checksum covers the complete ICMP message, including the body, and not the IPv4 header that carries it.

The 8-bit type selects the message class; the 8-bit code refines it. Echo and timestamp messages are informational, while unreachable, redirect, time-exceeded and parameter-problem messages report errors. A handful of old types are formally deprecated and should be ignored or filtered.

08 00

Common code values

The second 32-bit word — the four bytes after the checksum — is where most ICMP parsers go wrong. Echo uses an identifier and sequence; redirect carries a gateway address; Parameter Problem carries a pointer. The error types that quote an original datagram also use the sixth octet for an RFC 4884 Length field when an extension structure is present.

Build an ICMPv4 message with the type-specific rest-of-header. The checksum is calculated after the header and body are assembled. Optionally wrap the message in a minimal IPv4 packet so you can paste a complete on-wire unit into a lab tool or capture.

no bytes built yet

Paste an ICMP message, an IPv4 packet with Protocol 1, or an Ethernet II frame carrying IPv4. The decoder validates both checksums, follows the type-specific rest-of-header, and parses quoted original datagrams and RFC 4884 extensions. Raw ICMP is accepted directly, which is useful when your capture tool strips the IP header.

• The checksum covers only ICMP. For ICMPv4, sum the eight-byte header and the entire body. There is no pseudo-header. A receiver summing the message including the checksum should get 0xFFFF.
• Error messages quote the trigger. Destination Unreachable, Redirect, Source Quench, Time Exceeded and Parameter Problem carry the original IPv4 header and at least eight bytes of its payload. The quote may be truncated or rewritten by NAT.
• Length is in 32-bit words. RFC 4884 reuses the sixth octet for the length of the original datagram when an extension structure is present. Zero means no extension. The quoted datagram is padded to a 4-byte boundary.
• Type 3 code 4 is path-MTU discovery. The next-hop MTU in the rest-of-header tells the sender how small to fragment. Filtering this message can cause TCP black holes, especially with DF set.
• TTL expiry is not an error in the transport sense. Time Exceeded is normal traceroute behavior. The quoted datagram is how the sender knows which probe expired.
• Redirects are a security liability. A host that accepts ICMP redirects can be steered through an attacker. Most modern stacks ignore redirects by default or require strict source/interface checks.
• No authentication. ICMP has no signature, nonce or source authentication. The checksum detects accidental corruption only. ICMP filtering, rate limiting and quoted-packet validation are operational controls, not protocol guarantees.
• Deprecated does not mean absent. RFC 6633 deprecates Source Quench; RFC 6918 deprecates types 6, 15, 16, 17, 18 and 30–39. Old devices and lab traffic still emit them.

References

• RFC 792ICMP
• RFC 1122Host requirements
• RFC 1812Router requirements
• RFC 1191Path MTU Discovery
• RFC 950Address Mask Request/Reply
• RFC 1256Router Discovery
• RFC 1393Traceroute message
• RFC 4884ICMP extensions
• RFC 8335Extended Echo / PROBE
• RFC 6633Source Quench deprecation
• RFC 6918Deprecated ICMPv4 types
• RFC 4443ICMPv6