ICMP is a service protocol that is part of IP. It is used to signal abnormal events in networks built on the IP protocol. ICMP wraps its packets into an IP datagram, i.e., if we capture transported datagrams, we can later find a link header then an IP header followed by the header of the ICMP packet.
It is possible to signal various states with ICMP; however, the reality is that any specific implementation of TCP/IP can only support a certain number of these signals and, above all, many ICMP signals may be discarded by routers for security reasons.
An ICMP packet header is always 8-bytes long (see Figure 5.10). The first four bytes always have the same meaning, and the contents of the remaining four depend on the ICMP packet type.
Figure 5.10: ICMP packet
The first four bytes of the header always contain the message type, message code, and a 16-bit checksum. The message format depends on the value of the type field. The type field is a rough division...