What is ICMP?

Internet Control Message Protocol (ICMP) is a network-layer protocol that routers and hosts use to report errors and exchange operational information – unreachable destinations, time-exceeded packets, and echo requests and replies. It carries no user data itself; it exists to signal what happened to IP traffic, making it the basis for tools like ping and traceroute.

Key takeaways

• ICMP reports errors and diagnostics for IP traffic, not user data.
• Echo request and reply messages are the basis for the ping utility.
• VOS devices use ICMP probes for SLA monitoring and route liveness checks.
• Time-exceeded messages make traceroute’s hop-by-hop path discovery possible.
• ICMP can be disabled, enabled, or made variable per WAN interface in VOS.

On this page: Why it matters · How it works · Types · ICMP & Versa · FAQ

Why is ICMP important?

ICMP is how the network layer talks about itself. Without it, a router that drops a packet because a destination is unreachable, or because its TTL expired, would have no way to tell the sender – packets would simply vanish, and every failure would look identical: silence. ICMP turns that silence into an explicit signal: destination unreachable, time exceeded, fragmentation needed. That signal is what lets endpoints and management tools distinguish “the network is slow” from “the network is broken,” and it’s the raw material behind two of networking’s most basic utilities, ping and traceroute.

ICMP’s importance also shows up in day-to-day operations. Any path-aware network needs a lightweight way to ask “is this next hop still there?” many times a second across many links; a heavyweight application-layer probe would be too costly to run at that scale. ICMP echo requests are the cheapest possible answer to that question, which is why liveness checks, static-route monitors, and SLA probes across the industry – including VOS deployments – lean on it as a default probe type alongside DNS and TCP.

What is ICMP?

ICMP messages travel inside IP packets – protocol number 1 for IPv4, protocol number 58 for ICMPv6 – but they are not carried over a transport-layer protocol like TCP or UDP, so there are no ports involved. Each message has a type and a code that together identify what happened: type 8 is an echo request, type 0 is an echo reply, type 3 is destination unreachable (with codes for host, network, and port unreachable, among others), and type 11 is time exceeded, sent when a packet’s TTL reaches zero.

Because ICMP reports on IP delivery itself, routers generate it automatically as packets transit the network – a host never has to request it. That’s what makes traceroute possible: it sends packets with increasing TTL values and reads the time-exceeded replies from each hop along the path. It’s also why ICMP is a frequent target of firewall policy – because it’s automatic and low-level, unrestricted ICMP can leak topology information or be abused for reconnaissance, so most networks permit it selectively rather than allow it unconditionally.

Types of ICMP

Two protocol versions exist. ICMPv4 (RFC 792) is the original, used with IPv4, covering echo, unreachable, redirect, and time-exceeded messages. ICMPv6 (RFC 4443) serves IPv6 and absorbs duties IPv4 delegates elsewhere – neighbor discovery and stateless address autoconfiguration both run over ICMPv6 rather than a separate protocol.

Within each version, messages split into two classes. Error messages – destination unreachable, time exceeded, parameter problem – report a delivery failure back toward the original sender. Informational messages – echo request/reply, router advertisement/solicitation – carry no error; they’re queries and responses used for diagnostics and discovery. Ping uses the informational pair; traceroute relies on the error pair. Most operational ICMP traffic, including SLA and reachability monitoring, is built from this same small set of echo and error messages rather than the protocol’s less-common options.

ICMP & Versa

ICMP is a first-class option on VOS interface configuration, not an afterthought. WAN interfaces – physical, PPPoE, and loopback – can each be set to Disabled, Enabled, or Variable for ICMP transmission, letting an operator choose per-device, per-interface exposure through WAN interface configuration in Concerto. Subinterfaces carry an ICMP Reply toggle plus error-reporting Interval and Threshold settings, configured in Configure Interfaces; VOS devices reply to ICMP requests by default, but that behavior can be turned off.

Beyond interface policy, VOS uses ICMP as a monitoring probe. Static routes can attach ICMP-based monitor objects that withdraw a route when probes fail, and SD-WAN SLA measurements use ICMP alongside DNS and TCP as active-monitoring probe types for path selection and SaaS application monitoring, as described in the SD-WAN design guide. In active-active HA branch topologies, ICMP monitoring across the cross-connect link is what detects a failed peer device and triggers static-route withdrawal.

Frequently asked questions

What is the difference between ICMP and TCP or UDP?

TCP and UDP are transport-layer protocols that carry application data between ports; ICMP is a network-layer protocol with no ports that carries operational and error messages about IP delivery itself. ICMP isn’t a substitute for either – it reports on the network, it doesn’t move application traffic.

Why does ping use ICMP?

Ping sends an ICMP echo request and waits for an echo reply. The exchange needs no application, port, or session state – just two hosts capable of processing IP – which makes it the simplest possible test of basic reachability and round-trip latency between two points.

Why do firewalls block or restrict ICMP?

Because ICMP is generated automatically and operates below the application layer, unrestricted ICMP can reveal internal topology to a scanner or be abused for flooding and reflection attacks. Most firewall policies permit specific message types – echo and destination-unreachable – while blocking or rate-limiting the rest.

What is the difference between ICMPv4 and ICMPv6?

ICMPv4 (RFC 792) handles error and diagnostic messages for IPv4. ICMPv6 (RFC 4443) does the same for IPv6 but also absorbs functions IPv4 handled separately, including neighbor discovery and stateless address autoconfiguration, making it more central to how IPv6 networks operate.

How does traceroute use ICMP?

Traceroute sends a sequence of packets with increasing TTL values. Each router that discards an expired packet returns an ICMP time-exceeded message, revealing itself as a hop; when the destination finally responds, traceroute has assembled the full path one hop at a time.

More on ICMP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ICMP, these are worth looking at next.