What is ICMP?
Internet Control Message Protocol
ICMP (Internet Control Message Protocol) is the protocol IP uses to report errors and carry diagnostic messages, and it is what ping and traceroute rely on.
ICMP for IPv4 is defined in RFC 792 and is carried directly in IP packets as protocol number 1. Every message has a type and a code. The ones you meet most are echo request (type 8) and echo reply (type 0), which ping uses; time exceeded (type 11), which a router sends when it decrements a packet's TTL to zero; and destination unreachable (type 3), whose codes say why, such as network unreachable, host unreachable, port unreachable or administratively prohibited. Code 4 of destination unreachable, "fragmentation needed", tells a sender its packet was too big for the next link and had the DF bit set. ICMP error messages include the start of the packet that caused them, so the sender can work out which connection the error belongs to. IPv6 has its own version, ICMPv6, which also handles neighbour discovery.
traceroute works by sending probes with a TTL of 1, 2, 3 and so on, and listening for the time-exceeded messages each router sends back. Rows of * * * often just mean a router rate-limits or doesn't send ICMP, not that the path is broken. The most damaging mistake is blocking all ICMP at a firewall "for security": this throws away the fragmentation-needed messages that PMTUD depends on, so small packets work but large transfers hang, a classic MTU black hole. Filter echo requests if you must, but let the error messages through. The Linux Network Connectivity lesson uses ping and traceroute on a real lab, and Packets That Never Come Back diagnoses an MTU black hole.
Lessons that use ICMP
- Linux Network ConnectivityTeaches this term · Beginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Zone-based firewall on VyOSIntermediate · 35 min
Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.
- Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min
Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.
- Debugging BGP: every session state, reproducedIntermediate · 60 min
Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.
- IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min
Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.
- Edge and core: building out a VyOS networkIntermediate · 60 min
Split one BGP router into edge routers that face the outside world and a core that carries traffic inside: loopbacks, OSPF for infrastructure, iBGP between loopbacks, next-hop-self, and what happens when a link fails. Built and broken on three real VyOS routers.
- Setting up VyOS with NATBeginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.