PROTOCOLS-FUN . PACKET ANATOMY

ICMPv4 Anatomy

ICMP for IPv4 (RFC 792): error, diagnostic and echo messages.

Every ICMPv4 message opens with the same 4 bytes; the type field alone tells a receiver which of roughly a dozen message shapes follows.

generic header (4 bytes)

Checksum shown as a placeholder here since a real one needs a full message body - see the other tabs for worked examples.

What every ping command actually sends. Identifier and sequence let a sender match replies to requests when several pings are in flight at once; the payload is arbitrary and usually just a byte-counting pattern.

Echo Request (16 bytes: 8-byte header + 8-byte payload)

A reply is byte-identical except type=0 and the checksum recomputed for that type change.

One type, sixteen meanings via the code field. Code 4 is the one with real teeth: "fragmentation needed but the Don't Fragment bit was set" - the message that drives IPv4 Path MTU Discovery, carrying the next hop's MTU in what would otherwise be unused bytes (RFC 1191).

Destination Unreachable, code 4 (8 bytes)

A router telling the sender: your packet needed fragmenting, DF was set, so I dropped it - retry at 1480 bytes instead.

Sent when TTL hits zero in transit (code 0) or a fragment reassembly timer expires before all fragments arrive (code 1). Code 0 from every router along a path, one hop-count at a time, is literally what traceroute is built out of.

Time Exceeded, code 0 (8 bytes)

In 1981, this was IP's only congestion-control signal: a router sends Source Quench to tell a sender "slow down." Same byte shape as Time Exceeded - the interesting part is entirely what happened to it, not what's in it.

Source Quench, historical (8 bytes)
deprecated, not just unused. RFC 6633 (2012) doesn't just note that Source Quench fell out of favor - it mandates active rejection: hosts "MUST NOT send" it, and TCP/UDP/SCTP/DCCP implementations "MUST silently discard" any they receive. Major stacks had already stopped honoring it years earlier; the RFC formalized what was already true in practice. Its replacement for congestion signaling isn't a new ICMP message at all - it's ECN, a couple of repurposed bits in the TCP/IP header itself. See the TCP anatomy page's Flags: 2001+ tab.