Internet Core Protocols: The Definitive Guide

Query message headers

Since ICMP query messages are used for specific types of functionality, they vary widely in their formatting. However, each of them share the same first three header fields, as shown in Table 5.10, along with their size (in bytes) and some usage notes. Beyond these common fields however, each of the ICMP query messages differs widely in their formatting and structure. For more information on these fields, refer to the individual discussions throughout this section.

Table 5.10. Format of the ICMP Query Message

Field	Bytes	Usage Notes
Type	1	Indicates the specific ICMP query message
Code	1	Indicates the subclass of the ICMP query message
Checksum	2	Used to validate the contents of the ICMP query message
Additional Fields	var	Varies by message

The total length of a “normal” ICMP query message is eight bytes. However, this does not include any additional data that may be provided by an ICMP query message’s additional fields, which can add a substantial amount of data to a datagram (Echo Request messages can be as large as 64 kilobytes).

All ICMP messages are sent within IP datagrams directly. Each of these datagrams must have a protocol identifier of 1. In addition, RFC 1122 states that ICMP error messages should use the default Type-of-Service and Precedence values when they are sent over IP. However, if a user wishes to set these values to higher levels, then the responses must use the same values they received in the queries.

The following sections discuss ICMP query messages ...