Understanding Linux Network Internals

Applications of the ICMP Protocol

ICMP messages can be transmitted both by the kernel and by user-space applications. The user-space applications use the raw IP socket interface that we briefly introduced in Chapter 13. Two well-known examples of network troubleshooting tools that use the ICMP protocol are traceroute and ping. Other users of the raw IP socket interface for transmitting or listening to ICMP messages are routing protocols.

ping

ping does not need an introduction. For most people, it represents the first command learned when approaching the networking area. Given an input IP address and a set of optional flags, it transmits an ICMP_ECHO message to the input IP address, and prints the round-trip time and other information when it receives the associated ICMP_ECHOREPLY message. You can find the history of ping at http://ftp.arl.mil/~mike/ping.html, the home page of its creator.

traceroute

traceroute is probably the first command you learned after ping. It is used to determine the path between the host where the command is issued and a given destination IP address. The path is represented by the list of IP addresses of the intermediate routers.

traceroute can achieve its goal by using either UDP or ICMP.^[*] By default, it uses UDP, but you can force the use of ICMP with the -I switch option. As we will see, the UDP method also depends on an ICMP message for its success. Both methods demonstrate considerable cleverness.

Let's see how the technique based on ICMP works. As we ...