ICMP, ping and traceroute: message types and how to read the results
In short: ICMP is IP's error and diagnostic messenger. Ping uses ICMP echo request and reply to test reachability and delay; traceroute uses expiring TTLs to make each router on the path reveal itself. Reading their output correctly, and allowing the right ICMP through firewalls, saves hours of troubleshooting.
What ICMP does
The Internet Control Message Protocol (ICMP) carries error reports and diagnostic messages for IP. It runs directly inside IP (protocol number 1; ICMPv6 is 58) and has no ports. Routers and hosts send ICMP messages back to a packet's source when something goes wrong, such as an unreachable network or an expired TTL.
| Type | Name | When you see it |
|---|---|---|
| 0 | Echo reply | The answer to a ping |
| 3 | Destination unreachable | Code 0 network, 1 host, 3 port unreachable, 4 fragmentation needed, 13 administratively prohibited (a filter) |
| 5 | Redirect | A router tells a host to use a better gateway on the same subnet |
| 8 | Echo request | A ping |
| 11 | Time exceeded | TTL reached zero in transit (traceroute relies on this) |
Ping: reachability and delay
ping sends echo requests and waits for echo replies. It tells you whether the target answered, the round-trip time, and whether any were lost. Read the output carefully:
- Reply from the target: the path works both ways at Layer 3.
- Request timed out: no reply came back. The request or the reply was lost, or a firewall dropped it. It does not prove the host is down.
- Destination host unreachable from 192.168.1.1: a router (here the gateway) could not deliver it, often because ARP for the host failed.
- TTL expired in transit: the packet ran out of hops, usually a routing loop.
On Cisco devices, ! means a reply, . a timeout and U unreachable. The first ping in a series often fails because the router is still resolving ARP.
Traceroute: the path hop by hop
Traceroute sends probes with TTL 1, then 2, then 3, and so on, usually three per hop. Each router that decrements a probe to zero drops it and returns ICMP Time Exceeded from its own address, so you learn every hop and its delay. Windows tracert uses ICMP echo probes. Linux, macOS and Cisco traceroute use UDP to high ports by default, and the final host answers with port unreachable.
tracert -d 203.0.113.10 (Windows, -d skips name lookups)
traceroute -n 203.0.113.10 (Linux and macOS)
traceroute -I 203.0.113.10 (Linux, use ICMP probes)
traceroute 203.0.113.10 (Cisco IOS)
pathping 203.0.113.10 (Windows: loss per hop over time)Reading stars: a line of * * * in the middle followed by normal hops just means that router does not reply to probes, which is common and harmless. Stars from one point onwards to the end suggest the traffic, or the replies, are blocked there. High delay at one hop that does not continue to later hops is usually the router de-prioritising its own replies, not real congestion.
ICMP and firewalls
Blocking all ICMP feels secure but breaks things. Path MTU discovery depends on "fragmentation needed", and IPv6 cannot work without Neighbour Discovery. A sensible policy for an internet edge is:
- Allow type 3 (especially code 4) and type 11 inbound, as they are replies to your own traffic.
- Allow outbound echo requests and their replies so staff can troubleshoot.
- Rate-limit or block inbound echo requests to internal hosts if policy requires it.
- For IPv6, allow the ICMPv6 types that RFC 4890 recommends, including NDP on local links.
- Disable ICMP redirects on routers (
no ip redirects) and on hosts unless needed.
Real-world example: a help desk escalated "the server is down" because ping timed out. Telnet to port 443 connected at once: the server's Windows firewall simply blocked inbound echo requests, which is the default on public profiles. Always test the actual service port before declaring a host unreachable.
Practice
Traceroute shows * * * at hop 4 but hops 5 to 9 reply normally. Is hop 4 a problem?
Which ICMP message does traceroute rely on, and why?
Why should a firewall allow ICMP type 3 code 4?
Key takeaways
- ICMP reports errors and diagnostics for IP; it has types and codes but no ports.
- Ping uses echo request (8) and echo reply (0); a timeout does not prove a host is down.
- Traceroute raises the TTL hop by hop and listens for Time Exceeded (11).
- Stars at one hop are usually harmless; stars to the end mean blocking.
- Never block all ICMP: allow type 3 and 11, and ICMPv6 NDP.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.