ICMP and path MTU - control messages and fragmentation

ICMP is the control-plane protocol of IP. It carries error messages (“destination unreachable”, “time exceeded”) and informational messages (echo request/reply for ping). ICMP is not for user data - the only application that “uses” it directly is ping.

Common ICMP types

IPv6 uses ICMPv6, which has additional types (neighbour solicitation, router advertisement, etc.) and is also essential to IPv6 itself - ICMPv6 is not optional for IPv6 the way ICMP is for IPv4.

How ping works

ping sends an ICMP Echo Request (type 8) to the destination. The destination replies with an Echo Reply (type 0). The round trip time is measured.

ping 10.0.0.1
ping -c 3 -W 2 10.0.0.1     # 3 attempts, 2s timeout
ping -s 1472 -M do 10.0.0.1 # send 1472 bytes, do not fragment
ping6 fe80::1%eth0

A successful ping means the destination is alive at layer 3 and ICMP is permitted by any firewall in the path.

A failed ping can mean many things:

• No route to host (routing problem).
• Destination unreachable (host down, firewall dropping).
• Request timed out (firewall silently dropping ICMP, or congestion).

How traceroute works

traceroute (or tracepath / mtr) walks the path to a destination by manipulating TTL:

1. Send a packet with TTL=1. The first router decrements TTL to 0 and replies with ICMP Time Exceeded (type 11). The sender learns router 1.
2. Send a packet with TTL=2. The second router replies. Sender learns router 2.
3. Continue until the destination replies (or the hop count exceeds the limit).

traceroute -n 8.8.8.8
traceroute -T -p 443 8.8.8.8     # use TCP SYN to bypass ICMP blocks
mtr -n 8.8.8.8                   # continuous traceroute
tracepath 8.8.8.8                # no root needed, uses UDP

In production, ICMP-based traceroute often fails because firewalls drop ICMP Time Exceeded. The -T flag uses TCP SYN packets, which are almost always permitted.

Path MTU discovery

Ethernet MTU is 1500 bytes. Some links (VPNs, PPPoE, GRE tunnels) have lower MTU. If a packet is larger than the MTU of any link in the path, it must be fragmented - which most modern networks disable for performance and security reasons.

Path MTU Discovery (PMTUD, RFC 1191) avoids this:

1. The sender sets the Don’t Fragment bit on outgoing packets.
2. If a router’s outgoing interface has a smaller MTU, it drops the packet and returns ICMP Destination Unreachable with code “fragmentation needed”.
3. The sender reduces its packet size to the MTU in the ICMP message and retries.

ip route get 10.0.0.5         # shows the cached MTU
tracepath -n 10.0.0.5         # walks the path; read the final "Resume: pmtu"
ping -M do -s 1472 10.0.0.5   # test 1500-byte packet, DF set

If PMTUD is broken (firewall drops the “fragmentation needed” ICMP), large connections silently fail or hang. This is one of the most common VPN-related problems.

Common MTU problems

The fix is usually to lower the MTU on the tunnel interface or on the host’s outbound interface:

ip link set eth0 mtu 1400

Or in Netplan / NetworkManager (covered in Part XX).

Knowledge check