What ICMP actually is
ICMP (Internet Control Message Protocol) rides directly inside IP (Internet Protocol; Protocol number 1, from the IPv4 header topic) rather than on top of TCP or UDP. It has no ports, no sessions, nothing to connect to. It exists purely to carry short, structured control and error messages between devices. Every ICMP message has a type and code that say exactly what it's reporting.
Ping: Echo request and reply
Ping is the simplest possible use of ICMP: send a type 8, Echo Request, and if the destination is reachable and willing to answer, it sends back a type 0, Echo Reply. No data exchanged beyond "are you there," and how long the round trip took.
Traceroute: Abusing TTL on purpose
Recall from the IPv4 header topic that every router decrements a packet's TTL (Time to Live) by one, and drops it with a type 11, Time Exceeded message if TTL hits zero. Traceroute turns that error condition into a mapping tool: it sends a packet with TTL=1, which dies at the very first router, revealing that router's address in the Time Exceeded reply. Then it sends one with TTL=2, which dies at the second router. It keeps incrementing until a packet finally survives all the way to the destination.
Each router's Time Exceeded reply comes from that router's own address, so by the time a probe finally survives to the destination, traceroute has assembled the full list of routers in between, one hop revealed per probe.
| ICMP message | Type | Meaning |
|---|---|---|
| Echo Request | 8 | "Are you there?", what ping sends |
| Echo Reply | 0 | "Yes.", what ping receives back |
| Destination Unreachable | 3 | A router or host couldn't deliver the packet at all |
| Time Exceeded | 11 | TTL hit zero, the mechanism traceroute is built on |
ICMP types and codes, in full
Every ICMP message carries both fields: type says the general category, code narrows it down within that category. Some types only ever have one code; others, like Destination Unreachable, use the code to say exactly why the packet couldn't be delivered.
| Type | Code | Meaning |
|---|---|---|
| 0 | 0 | Echo Reply |
| 3 | 0 | Network Unreachable |
| 1 | Host Unreachable | |
| 2 | Protocol Unreachable | |
| 3 | Port Unreachable | |
| 4 | Fragmentation Needed and DF set (see IPv4 Fragmentation) | |
| 5 | 0–3 | Redirect, "use this other gateway instead" |
| 8 | 0 | Echo Request |
| 11 | 0 | TTL exceeded in transit, what traceroute is built on |
| 1 | Fragment reassembly time exceeded | |
| 12 | 0 | Parameter Problem, a malformed IP header field |
Firewalls very commonly block ICMP outright as a hardening measure, since it can also be used to probe or map a network. A host that never replies to ping might be perfectly reachable on every port that actually matters. Treat "no ping" as "ICMP is filtered," not proof the host is down.