2.3 ICMP Protocol, Network Diagnostics & Error Messages

2.3 ICMP Protocol, Network Diagnostics & Error Messages

The Internet Control Message Protocol (ICMP) is an indispensable component of the Internet Protocol suite. While IP handles the forwarding of user data, ICMP provides the control and error-reporting mechanism across Layer 3. Security analysts must thoroughly understand ICMP message formats, diagnostic utilities, and firewall interaction rules. On the CREST CPSA examination, candidates are frequently assessed on specific ICMP Type/Code combinations, traceroute behavior differences across operating systems, Path MTU Discovery mechanics, and covert tunneling vectors.

---

1. ICMP Role & Architectural Rules

Defined for IPv4 in RFC 792 (and for IPv6 in RFC 4443), ICMP is fundamentally a Layer 3 companion protocol. It does not run over transport protocols like TCP or UDP; instead, ICMP messages are encapsulated directly within IPv4 datagrams carrying an IP Protocol number of 1 (or Protocol 58 for ICMPv6).

+-----------------------+-----------------------+-----------------------+
| Layer 2 Frame Header  | Layer 3 IPv4 Header   | ICMP Message          |
| (Ethernet)            | (Protocol = 1)        | (Type, Code, Payload) |
+-----------------------+-----------------------+-----------------------+

Non-Recursive Error Suppression Rules

To prevent network congestion and catastrophic packet storms, RFC 792 establishes strict restrictions governing when an ICMP error message can be emitted:

1. An ICMP error message must never be generated in response to another ICMP error message (it may, however, be generated in response to an ICMP query message, such as Echo Request).
2. An ICMP error message must never be sent in response to a datagram addressed to an IP broadcast or multicast address.
3. An ICMP error message must never be generated for a datagram sent as a link-layer broadcast (e.g., Ethernet FF:FF:FF:FF:FF:FF).
4. An ICMP error message must never be generated for an IP fragment other than Fragment 0.

---

2. ICMP Message Structure

All ICMP messages share a unified 4-byte base header, followed by a variable-length data payload:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Type      |     Code      |          Checksum             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 Message-Specific Header Data                  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Data Payload                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Type (8 bits): Specifies the overarching category of the ICMP message (e.g., Echo Request, Destination Unreachable, Time Exceeded).
• Code (8 bits): Provides granular diagnostic context or the specific subtype within the designated Type.
• Checksum (16 bits): 1's complement checksum covering the entire ICMP message (header and payload).
• Message-Specific Data (32 bits):
  • For Query Messages (Echo Request/Reply): Contains a 16-bit Identifier and a 16-bit Sequence Number used by the client to match ping replies to specific outbound requests.
  • For Path MTU Discovery (Type 3, Code 4): Contains the 16-bit Next-Hop MTU value.

The Original Datagram Payload Requirement

When an intermediate router or receiving host generates an ICMP Error Message (such as Destination Unreachable or Time Exceeded), RFC 792 mandates that the message payload must include the entire original IPv4 header PLUS at least the first 8 bytes (64 bits) of the original datagram's payload.

Why the first 8 bytes? In TCP and UDP, the first 8 bytes of the transport payload contain the Source Port (bytes 0-1) and Destination Port (bytes 2-3), as well as the initial sequence numbers. By inspecting this embedded payload, the originating host's operating system kernel can immediately correlate the ICMP error back to the specific application socket and process that initiated the connection.

+--------------------+---------------------+---------------------------------------+
| ICMP Error Header  | Original IP Header  | First 8 Bytes of Original L4 Payload  |
| (Type, Code, Chk)  | (20 bytes)          | (Source Port, Dest Port, Seq Num)     |
+--------------------+---------------------+---------------------------------------+

---

3. Essential ICMP Types and Codes for CPSA

The following table outlines the critical ICMP Types and Codes assessed on the CREST CPSA examination:

+-------+-------+-----------------------------------------------+-----------------------------------+
| Type  | Code  | Name / Description                            | Assessment & Reconnaissance Value |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 0     | 0     | Echo Reply                                    | Target is alive (ping response).  |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 3     | -     | Destination Unreachable                       | Routing, host, port, or filter    |
|       |       |                                               | failure.                          |
|       | 0     | - Network Unreachable                         | Routing table failure.            |
|       | 1     | - Host Unreachable                            | ARP resolution failure on subnet. |
|       | 2     | - Protocol Unreachable                        | OS lacks L4 protocol handler.     |
|       | 3     | - Port Unreachable                            | Core of UDP port scanning (-sU).  |
|       | 4     | - Fragmentation Needed and DF Set             | Path MTU Discovery (PMTUD).       |
|       | 9     | - Destination Network Prohibited              | Administrative firewall ACL drop. |
|       | 10    | - Destination Host Prohibited                 | Administrative firewall ACL drop. |
|       | 13    | - Communication Administratively Prohibited   | Explicit stateful firewall reject.|
+-------+-------+-----------------------------------------------+-----------------------------------+
| 5     | -     | Redirect                                      | Gateway route optimization.       |
|       | 0     | - Redirect for Network                        | Obsolete / insecure routing.      |
|       | 1     | - Redirect for Host                           | Exploited in ICMP MITM attacks.   |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 8     | 0     | Echo Request                                  | Standard ping probe.              |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 11    | -     | Time Exceeded                                 | Hop limit reached or reassembly.  |
|       | 0     | - Time to Live Exceeded in Transit            | Engine of traceroute.             |
|       | 1     | - Fragment Reassembly Time Exceeded           | Host reassembly timeout expired.  |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 12    | 0     | Parameter Problem: Bad IP Header              | Pointer indicates invalid offset. |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 13    | 0     | Timestamp Request                             | Information disclosure: reveals   |
| 14    | 0     | Timestamp Reply                               | target host system clock (UTC).   |
+-------+-------+-----------------------------------------------+-----------------------------------+
| 17    | 0     | Address Mask Request                          | Information disclosure: reveals   |
| 18    | 0     | Address Mask Reply                            | target internal subnet mask.      |
+-------+-------+-----------------------------------------------+-----------------------------------+

Security Implications of Specific Types

• ICMP Redirect Attacks (Type 5): When a router detects that a host is sending traffic through it that could more efficiently reach another router on the same local subnet, it forwards the packet and sends an ICMP Type 5 (Redirect) to the sender. In an assessment scenario, an attacker on the local link can spoof ICMP Redirects to trick victim hosts into routing all gateway-bound traffic through the attacker's machine, executing a stealthy Man-in-the-Middle (MITM) attack. Modern secure operating systems ignore ICMP redirects by default.
• ICMP Information Leakage (Types 13/14 and 17/18): Legacy systems responding to Timestamp Requests reveal their exact system clock in milliseconds past midnight UTC, aiding attackers in predicting time-based tokens or sequence numbers. Address Mask requests leak the internal subnet configuration.
• Administrative Filtering (Type 3 Code 13): When a penetration tester sees Type 3 Code 13 returned in response to a scan, it confirms the presence of an active packet filter or stateful firewall (e.g., a Cisco router ACL configured with deny ... or an iptables rule utilizing -j REJECT --reject-with icmp-admin-prohibited).

---

4. Network Diagnostic Utilities: Traceroute Mechanics

Traceroute maps the Layer 3 path across intermediate routers between a source host and a destination endpoint. A common CPSA examination question focuses on the architectural difference between the Microsoft Windows implementation and the standard Unix/Linux implementation.

Windows Implementation: tracert.exe

• Uses ICMP Echo Request (Type 8, Code 0) packets exclusively.
• Step 1: Sends an ICMP Echo Request with $\text{TTL} = 1$.
  • Router 1 decrements TTL to 0, discards the packet, and returns ICMP Type 11 Code 0 (Time Exceeded in Transit). tracert records the router's IP and round-trip time.
• Step 2: Sends an ICMP Echo Request with $\text{TTL} = 2$. Router 2 returns ICMP Type 11 Code 0.
• Final Step: When the packet reaches the target endpoint with $\text{TTL} = 1$, the destination host processes the packet normally and returns an ICMP Type 0 Code 0 (Echo Reply). This informs tracert that the destination has been reached.

Unix / Linux Implementation: traceroute

• By default, uses UDP datagrams directed to high, unallocated ports (starting at port 33434 and incrementing by 1 for each probe: 33434, 33435, 33436...).
• Intermediate Hops: Identical to Windows: intermediate routers decrement TTL to 0 and return ICMP Type 11 Code 0 (Time Exceeded).
• Target Endpoint Behavior: When the UDP datagram reaches the ultimate destination, the host inspects the high destination port (e.g., 33440). Because no application is listening on that port, the destination host returns an ICMP Type 3 Code 3 (Port Unreachable) message! This error message signals to the Unix utility that the packet reached the target.

   Windows tracert:  Probe: ICMP Type 8 (Echo Req)  ===> Final Target Reply: ICMP Type 0 (Echo Reply)
   Unix traceroute:  Probe: UDP Port 33434+         ===> Final Target Reply: ICMP Type 3 Code 3 (Port Unreachable)

Alternative Modes: Modern Unix traceroute supports -I for ICMP mode (matching Windows) and -T for TCP SYN traceroute (typically directed to port 80 or 443), which allows analysts to trace routes through enterprise firewalls that block inbound UDP and ICMP.

---

5. Path MTU Discovery (PMTUD) & ICMP Black Holes

To maximize throughput, endpoints attempt to transmit the largest possible IP datagrams without undergoing router fragmentation.

PMTUD Mechanics (RFC 1191)

1. The sending host sets the Don't Fragment (DF) bit to 1 in the IPv4 header of all transmitted packets.
2. If a packet encounters an intermediate link whose Maximum Transmission Unit (MTU) is smaller than the datagram size (e.g., standard Ethernet MTU 1500 bytes entering a PPPoE or IPsec tunnel with MTU 1420 bytes), the router cannot fragment the packet.
3. The router drops the datagram and returns an ICMP Type 3, Code 4 message: "Destination Unreachable: Fragmentation Needed and DF Set".
4. RFC 1191 specifies that the router includes the Next-Hop MTU value in bytes within the ICMP header.
5. The sending host reads the Next-Hop MTU and adjusts its Path MTU (and TCP MSS) downward accordingly.

The "ICMP Black Hole" Router Problem

Many network administrators mistakenly configure perimeter firewalls to blindly drop all incoming ICMP packets to prevent ping sweeps. When an intermediate router drops an oversized packet and attempts to send an ICMP Type 3 Code 4 notification, the firewall drops the ICMP message.

• Symptoms:
  • The initial TCP 3-way handshake completes successfully because SYN and SYN-ACK segments are small (typically under 100 bytes).
  • Simple terminal commands (e.g., executing a short command in SSH or browsing a tiny HTML page) succeed.
  • As soon as the server transmits a bulk data response that fills a full 1500-byte MTU frame (e.g., an SCP file transfer, large web page, or SSL/TLS certificate exchange), the connection hangs indefinitely and times out without transferring data.
• Mitigation: Allow ICMP Type 3 Code 4 at all network boundaries, or implement TCP MSS Clamping on intermediate routers (iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu).

---

6. ICMP Covert Channels & Tunneling

Because firewalls frequently permit outbound ICMP Echo Requests (Type 8) to allow internal administrators to ping external hosts, attackers exploit ICMP as an evasion and data exfiltration covert channel.

Tunneling Mechanics

Tools like ptunnel (Ping Tunnel) and icmpsh take advantage of the arbitrary data payload field of ICMP Echo Request and Echo Reply packets:

1. The attacker client encapsulates a full TCP stream, SSH session, or command-and-control (C2) shell inside the payload of outbound ICMP Type 8 Echo Requests.
2. The attacker's listening server on the internet intercepts the ping, extracts the nested protocol data, processes it, and returns the response encapsulated inside an inbound ICMP Type 0 Echo Reply.

+-----------------------------------------------------------------------+
| Standard ICMP Ping Payload (Windows):  "abcdefghijklmnopqrstuvwabcdefg" (32 bytes) |
+-----------------------------------------------------------------------+
| Covert Tunnel Payload:                [Encrypted C2 Shell Traffic / SSH Stream]    |
+-----------------------------------------------------------------------+

Detection & Analysis

• Payload Size Anomalies: Standard OS ping utilities transmit fixed payloads (Windows uses 32 bytes; Linux uses 56 bytes). ICMP tunneling frames typically carry maximum-length payloads (e.g., 1000+ bytes).
• High Entropy: Encrypted or compressed data inside ICMP payloads exhibits high Shannon entropy, contrasting with static plaintext alphabet patterns.
• Frequency & Volume: A continuous stream of high-frequency ICMP traffic between a single workstation and an unfamiliar external IP address indicates tunneling.