1

Network Administration

Module 5

ICMP and IGMP

2

TCP/IP Protocol Structure

ICMP

SMTP DNSTelnetFTP HTTP...

UDP TCP

IPICMP IGMP

ARP RARP

DATA LINK

PHYSICAL

Link Layer

Internet Layer

Transport Layer

Application Layer

3

ICMP (Reference RFC 792) Internet Control Message Protocol (ICMP) is one of the core

protocols of the Internet Protocol Suite ICMP is a protocol used for exchanging error or control messages

between routers or hosts ICMP uses IP to deliver messages to the original source ICMP messages are usually generated and processed by the IP

software, not the user process (i.e. it is not processed by software application)

ICMP can only report error, congestion, or other network condition. It does nothing to enhance IP’s best effort delivery approach.

Note:ICMP messages themselves are nothing more than specially formatted IP datagram, subject to the same conditions as other IP packets in the general network traffic.

4

Encapsulation of ICMP packet

ICMPmessage

IPheader

IPdata

Frame dataFrameheader

Trailer(if any)

5

ICMP Messages

ICMP message

QueryError-reporting

6

General format of ICMP messages

Type Code Checksum

Rest of the header

Data Section

8 bits 8 bits 8 bits8 bits

7

Type of ICMP Messages

ICMP Message Type Use or Significance

ICMP Echo / Echo Reply Supports functionality for reachability utilities like PING and TRACEROUTE; essential when installing, configuring and troubleshooting IP networks

ICMP Destination Unreachable

Documents when routing or delivery errors prevents IP datagrams from reaching their destinations; code values are extremely important.

ICMP Source Quench Permits a receiving host or intermediate gateway to instruct a sending host to adjust (lower) its sending rate to ease congestion problem

ICMP Redirect Permits a gateway (router) on a non-optimal route between sender and receiver to redirect traffic to a more optimal path

8

Type of ICMP Messages

ICMP Message Type

Use or Significance

ICMP router Discovery Permits hosts to request information about local routers, and routers to advertise their existence on an IP network

ICMP Time Exceeded Indicates that an IP datagram’s TTL or a fragmented IP datagram’s reassembly timer, has expired; can indicate either a too-short TTL, or the presence of a router loop on a network (which must be removed)

ICMP Parameter Problem Indicates some error occurred while processing the IP header of an incoming datagram, causing that datagram to be discarded; catchall for ambiguous or miscellaneous errors, it indicates further investigation is required

9

ICMP Functions

ICMP provides a way to return information to sender, in the form of specific kind of ICMP messages, about route traveled (including reachability information) as packet get forwarded and a positive way to return error information to a sender when routing or reachability problem prevent delivery of an IP datagram.

10

Time-To-Live (TTL)

Time-to-live (TTL) field of the IP Header is defined to be a timer limiting the lifetime of a datagram.

It is an 8-bit field and the units are seconds. Each router that handles a packet MUST decrement the TTL by at least one, even if the elapsed time was much less than a second.

Since this is very often the case (decrement for a second) the TTL is effectively a hop count limit on how far a datagram can propagate through the Internet.

11

ICMP Utilties

ICMP’s most common uses are testing and troubleshooting. Two of the most well known utilities, ping and traceroute rely on ICMP to perform connectivity test and path discovery.

Other tools e.g VisualRoute (http://www.visualroute.com)

WinMTR (http://winmtr.sourceforge.net)

12

traceroute

It prints the path a packet takes to reach its destination showing the names of all the intermediate routers

Making use of the following ICMP messages Time exceeded Destination unreachable

[root@CimLinuxServer ~]# traceroute www.cisco.comtraceroute to www.cisco.com (198.133.219.25), 30 hops max, 38 byte packets 1 192.168.19.249 (192.168.19.249) 0.364 ms 0.279 ms 0.256 ms 2 fw17.vtc.edu.hk (192.168.16.176) 1.211 ms 1.172 ms 1.028 ms 3 cw7204.vtc.edu.hk (202.40.210.220) 1.819 ms 1.870 ms 2.380 ms 4 218.189.111.201 (218.189.111.201) 4.417 ms 4.738 ms 4.880 ms 5 210.0.247.6 (210.0.247.6) 5.706 ms 4.338 ms 5.259 ms 6 62.216.146.241 (62.216.146.241) 6.742 ms 5.772 ms 4.490 ms

Note: You may use the “-c” option to specify the no. of ping packets.e.g. ping –c 4 172.21.2.30

13

traceroute (Linux / Unix)

It determines the path by sending a series of UDP probe packets with TTL fields 1, 2, 3, …

This causes each intermediate router on the path to send a Time Exceeded message back to the sender

14

Illustration: TTL=1

A B

Router X Router Z

Router Y

IP

ICMP

IP

Time ExceededPacket will be discarded

Extract information about router X from packet Create a probe packet

TTL=1

TTL=0

15

Illustration: TTL=2

A B

Router X Router Z

Router Y

IP TTL=2

Extract information about router Y from packet Create a probe packet

IP TTL=1 IP

Packet will be discarded

TTL=0

ICMP

16

Illustration: TTL=3

A B

Router X Router Z

Router Y

IP TTL=3

Extract information about router Z from packet Create a probe packet

IP TTL=2 IP TTL=1ICMP

IP TTL=0

17

Illustration: TTL=4

A B

Router X Router Z

Router Y

IP TTL=4

Create a probe packetExtract information from packet

IP TTL=3 IP TTL=2

ICMP

IP TTL=1

Destinationunreachable

18

tracert (Windows)

Windows equivalent of traceroute Use ICMP echo requests and echo replies Send packets to port 7 instead of a high port

19

Illustration: TTL=4 (tracert)

A B

Router X Router Z

Router Y

IP TTL=4

Create a probe packetExtract information from packet

IP TTL=3 IP TTL=2

ICMP

IP TTL=1

It is a echo-request

echo-reply

20

ping

A utility to check whether other machines are reachable It sends out a series of ICMP echo-request and then captures

echo-reply messages It provides statistical information for network testing,

measurement and management

[root@CimLinuxServer ~]# ping www.yahoo.comPING www.yahoo-ht2.akadns.net (209.131.36.158) 56(84) bytes of data.64 bytes from f1.www.vip.sp1.yahoo.com (209.131.36.158): icmp_seq=0 ttl=55 time=162 ms64 bytes from f1.www.vip.sp1.yahoo.com (209.131.36.158): icmp_seq=1 ttl=55 time=156 ms64 bytes from f1.www.vip.sp1.yahoo.com (209.131.36.158): icmp_seq=2 ttl=54 time=172 ms

21

Stop responding from ping

You may use the following command to stop your machine from responding to ping from other machine

[root]#echo 1 > /proc/sys/net/ipv4/echo_icmp_ignore_all

Note:A ping of death (abbreviated "POD") is a type of attack on a computer that involves sending a malformed or otherwise malicious ping to a computer. 

22

IGMP

The Internet Group Message Protocol (IGMP) has been designed to help a multicast router identify the hosts in a LAN that are members of a multicast group

IGMP has only 2 types of messages: report and query The report message is sent from the host to router The query message is sent from the router to the hosts

23

Unicast

Unicast is the term used to describe communication where a piece of information is sent from one point to another point. In this case there is just one sender, and one receiver.

Unicast transmission, in which a packet is sent from a single source to a specified destination, is still the predominant form of transmission on LANs and within the Internet. All LANs (e.g. Ethernet) and IP networks support the unicast transfer mode, and most users are familiar with the standard unicast applications (e.g. http, smtp, ftp and telnet) which employ the TCP transport protocol.

24

Broadcast

Broadcast is the term used to describe communication where a piece of information is sent from one point to all other points. In this case there is just one sender, but the information is sent to all connected receivers.

Broadcast transmission is supported on most LANs (e.g. Ethernet), and may be used to send the same message to all computers on the LAN (e.g. the address resolution protocol (arp) uses this to send an address resolution query to all computers on a LAN). Network layer protocols (such as IP) also support a form of broadcast which allows the same packet to be sent to every system in a logical network.

25

Multicast Multicast is the term used to describe communication

where a piece of information is sent from one or more points to a set of other points. In this case there is may be one or more senders, and the information is distributed to a set of receivers (there may be no receivers, or any other number of receivers).

26

Multicast

Multicasting is the networking technique of delivering the same packet simultaneously to a group of clients. IP multicast provides dynamic many-to-many connectivity between a set of senders (at least 1) and a group of receivers. The format of IP multicast packets is identical to that of unicast packets and is distinguished only by the use of a special class of destination address (class D IP address) which denotes a specific multicast group. Since TCP supports only the unicast mode, multicast applications must use the UDP transport protocol.

27

Operation of IGMP in a single network A Mrouter connected to a LAN has a list of multicast address of the groups for

which there is at least one loyal member

LAN

Host

HostHost

R

... 225.70.8.20231.24.60.9

.

.229.60.12.8

Multicast router

List of groupshaving loyal members

28

Operation of IGMP in a single network (Cont) Joining a group

Each host maintains a list of processes with membership in a group

When a process want to join a group, it sends its request to the host, the host will add the name of the process and the name of the requested group to its list

Then the host sends a IGMP report to the multicast router

29

Operation of IGMP in a single network (Cont)

Monitoring group membership A multicast router is responsible for monitoring all of the

hosts in a LAN to see if they want to continue their membership

The router periodically sends a query message

30

Operation of IGMP in a single network (Cont)

Continue membership The host keeps a list of processes that wish to continue

membership in a group When a host receive a query, it checks this list For each group with at least one process still interested in

continuing the membership, the host must send a report

31

Operation of IGMP in a single network (Cont)

Leaving a group When a host receives a query and finds that there is not a

process interested in that group anymore, it does not respond and does not send a report about that group

If no host on the LAN sends a report for a specific group, the address of that group is deleted

32

Operation of IGMP in Internet

R2

Network A

Host

HostHost

Host

Network A

Host

HostHost

Host

Network A

Host

HostHost

Host

R1

R3

To the rest of the Internet

33

Operation of IGMP in Internet (Cont)

Multicast routing in an Internet is accomplished by using the spanning tree algorithm

The spanning tree algorithm is used in data structures to create a tree out of a group

34

RFC (Request for Comments)

Request for Comments, a series of notes about the Internet, started in 1969. An Internet Document can be submitted to the IETF by anyone, but the IETF decides if the document becomes an RFC. Eventually, if it gains enough interest, it may evolve into an Internet standard.

Each RFC is designated by an RFC number. Once published, an RFC never changes. Modifications to an original RFC are assigned a new RFC number.

e.g. rfc792 – ICMPrfc2236 – IGMPrfc2612 – HTTP version 1.1……