Internet Control Message Protocol (ICMP)

ICMP

• integral part of the Internet Protocol Suite which is a set of networking protocols used on the Internet

• network layer protocol that’s primarily used for diagnosing network communication issues and providing hosts with information about network problems

ICMP message purposes include

• when a service or host is unreachable

• when a packet’s time to live has expired

• when a router cannot forward packets due to its buffer being filled up

ping command uses…

ICMP to send an ICMP Echo Request message

latency

• round trip time of network connection

• Network latency is the delay in network communication. It shows the time that data takes to transfer across the network. Networks with a longer delay or lag have high latency, while those with fast response times have low latency.

ICMP message structure

• each message starts with a header consisting of:

  • Type

    • one bite long field that indicates the type of ICMP message being transmitted

  • Code

    • one bite long field that provides additional context about the message type

  • Checksum

    • two bite long field used for error checking the message header and data

ICMP lacks… but prioritizes…

the reliability mechanisms of TCP

• meaning there is no guarantee of the message being delivered, no ordering of the data, and no error correction capabilities at all inside of ICMP

ICMP prioritizes speed and simplicity over data integrity and security

2 attacks that exploit Internet Control Message Protocol

• ICMP Flood Attack

  • type of attack that involves overwhelming a target machine with a large number of ICMP Echo Request packets (aka ping packets)

• Ping of Death

  • attack that exploits a vulnerability that existed in older, unpatched systems where the attacker sends malformed or oversized packets using the ICMP protocol

• because of these vulnerabilities, many network admins may choose to block ICMP traffic

DDOS

where the attacker usually uses a network of compromised computers (called a botnet) to generate a signicant amount of traffic