What Is ICMP? Ping, Traceroute and Network Errors

ICMP (Internet Control Message Protocol) carries status and error messages between network devices, such as “destination unreachable” or “time exceeded”. It has no ports. Ping uses ICMP echo requests and replies; traceroute relies on ICMP time-exceeded messages.

How it works

Ping sends an ICMP Echo Request (type 8) to a host, which answers with an Echo Reply (type 0) used for timing.

ICMP sits alongside IP rather than on top of TCP or UDP, so it has types and codes instead of ports.

Common ICMP messages

Echo Request / Echo Reply (types 8 and 0): ping.
Destination Unreachable (type 3): with codes for network, host or port unreachable, and fragmentation needed, which path MTU discovery depends on.
Time Exceeded (type 11): a packet's TTL reached zero; traceroute uses this.
Redirect (type 5): a router suggesting a better next hop.

IPv6 uses ICMPv6, which does even more: Neighbor Discovery (the IPv6 replacement for ARP) and router advertisements run on it.

Should you block ICMP?

Blocking all ICMP is a common mistake. It breaks path MTU discovery (causing stalled large transfers), makes troubleshooting harder, and in IPv6 breaks basic connectivity. Rate-limiting echo requests is fine; dropping everything isn't.

When ping fails but the site works

Many servers and firewalls drop or deprioritise echo requests, so “no ping reply” doesn't mean a host is down.

Examples

$ ping -c 2 1.1.1.1
64 bytes from 1.1.1.1: icmp_seq=0 ttl=57 time=12.3 ms
64 bytes from 1.1.1.1: icmp_seq=1 ttl=57 time=14.4 ms

A full-size packet with “don't fragment” set shows the MTU limit:

$ ping -D -s 1473 1.1.1.1
ping: sendto: Message too long

On a Mac

ping and traceroute are built in; traceroute -I uses ICMP probes instead of UDP.
macOS's stealth mode (System Settings › Network › Firewall › Options) stops your Mac answering pings from others.

See it in the app

LightAtom's traceroute collects the ICMP time-exceeded replies from each router and plots them on the map.

Frequently asked questions

What is ICMP used for?

Error reporting and diagnostics: ping, traceroute, unreachable messages and path MTU discovery.

Does ICMP use a port?

No. ICMP messages have a type and code instead of port numbers.

Is it safe to block ICMP?

Blocking echo requests is common, but blocking all ICMP breaks MTU discovery and IPv6. Block selectively.

Why does ping time out when the website loads?

The server or a firewall in between drops ping traffic. Use a TCP check, like curl or a port checker, instead.