CNIT 344: Network Support & Control Protocols

What RFC defines ICMP?

RFC 792

What does ICMP provide to network operations?

Feedback messages about delivery and network issues

Is ICMP required for IP?

Yes

What does the RFC state about ICMP messages?

Messages should be created for control events and should be honored by receiving devices

Can broadcast or multicast messages create ICMP messages?

No, they can’t generate ICMP messages

What happens if an ICMP message encounters an error?

It cannot generate another ICMP error message (to prevent loops).

What does the “type” field define in an ICMP message?

The message format and general action

What does the “code” field define in an ICMP message?

Specific operational actions within a message type

What does the “checksum” field define in an ICMP message?

Error checking using a one’s complement sum of 16-bit sections

What determines each ICMP code?

It depends on the type it’s associated with

What do types with only one code use for the code value?

0

What two ICMP message types does ping use?

Type 8 and 0

What is the function of the echo request?

Sent by the source to test network reachability

What is the function of the echo reply?

Returned by the destination to confirm connectivity

What is the purpose of traceroute?

To determine the path a packet takes to a destination

How does traceroute work?

It records each hop by returning ICMP messages from intermediate routers

Why are ICMP unreachable messages generated?

Due to routing errors, dropped packets, or delivery issues.

How are different unreachable causes classified?

Each reason (no route, drop rule, delivery error) is distinct.

What do these messages indicate?

Failed delivery of a packet between devices.

Is ICMP secure?

No, it’s inherently insecure by design.

What are three common ICMP-based attacks?

Ping of Death, Smurf Attack, ICMP Sweep.

What makes ICMP vulnerable?

It can be exploited for amplification, scanning, or denial-of-service.

What should be blocked on external interfaces for security?

Incoming Echo Requests and Traceroute messages.

What messages should be rate-limited or blocked internally?

Outgoing Echo Requests and Destination Host Unknown messages.

How can ICMP-based OS fingerprinting be mitigated?

By using IDS/IPS systems and filtering Protocol/Port Unreachable messages.