In this lesson,
we're going to explore the Internet Control Message Protocol.
The Internet Control Message Protocol,
more commonly known as ICMP,
is an integral part of the Internet Protocol Suite,
which is a set of networking protocols
that are used on the internet.
Unlike TCP,
which is known as the Transmission Control Protocol,
and UDP, which is known as the User Datagram Protocol,
ICMP is not used for sending data
between two different systems.
Instead, ICMP is considered to be a network layer protocol
that's primarily used
for diagnosing network communication issues
and providing hosts with information about network problems.
ICMP is going to operate at the network layer of the OSI model,
and this means it's going to be encapsulated within the IP
or internet protocol packets as well.
This makes ICMP an essential tool
for error reporting and testing.
Now, ICMP messages are used for various purposes,
such as indicating when a service or host is unreachable,
when a packet's time to live has expired,
or when the router cannot forward packets
due to its buffer being filled up.
Most people are going to be familiar
with the PING command utility.
Now, the PING utility uses ICMP
to send an ICMP Echo Request message
to test the reachability of a host on a given IP network.
The receiving host,
if they're available and functioning properly,
will then respond with an ICMP Echo reply.
This utility is widely used to check network connectivity
and it measures the roundtrip time,
which we call latency of your network connection.
ICMP messages have a simple structure,
and each message starts with a header consisting
of three different things.
First, we have the Type,
which is a one byte long field
that indicates the type of ICMP message being transmitted.
Second, we have the Code,
which is a one byte long field
that provides additional context about the message type.
Third, we have the Checksum,
which is a two-byte long field
that's going to be used for error checking
the message header and data.
Now, after that header,
the ICMP message will contain different data based
on the type and code of the message
that's being transmitted.
For example, in the case of an Echo Request and Echo Reply,
the data section will include an identifier
and a sequence number
to match the replies with the requests,
as well as some optional data
that's being included in the reply.
It's important to note
that ICMP does not have any of the reliability mechanisms
that are used in the Transmission Control Protocol or TCP.
This means, there is no guarantee
of the message being delivered,
no ordering of the data,
and no error correction capabilities at all inside of ICMP.
Instead, ICMP is designed for speed and simplicity,
not for data integrity or security.
As a result, ICMP is typically used
for error handling and diagnostics,
rather than transmitting any kind
of regular user data over the network.
Now, unfortunately, over the years,
attackers and hackers have used ICMP
as part of their network attacks.
For example, the ICMP Flood Attack
and the Ping of Death are two common network-based attacks
that exploit the Internet Control Message Protocol.
An ICMP Flood Attack is a type of attack
that involves overwhelming a target machine
with a large number of ICMP Echo Request packets,
also known as Ping packets.
This type of attack is typically done
as fast as possible without waiting for replies
in order to consume the target system's resources
such as its bandwidth and its processing power
to the point where it can no longer handle
legitimate requests from its actual users.
This leads to what we call
a Denial of Service condition or DoS.
Now, a Denial of Service situation will actually occur
because legitimate users cannot receive services
from the system,
because it's currently being subjected
to an ICMP Flood Attack.
These days though,
this type of attack has to be amplified
from a Denial of Service Attack
up to a Distributed Denial of Service Attack
for it to be effective.
Now, a Distributed Denial of Service Attack,
also known as a DDoS or DDoS,
will occur when an attacker uses a network
of compromised computers,
known as botnets,
to generate a significant amount of traffic.
Distributed Denial of Service Attacks make
the attack more powerful,
harder to defend against,
and more difficult to trace back
to the original source of the attack
because numerous machines are being used
to attack the system all at once.
This kind of ICMP Flood Attack
is used to severely disrupt your network operations.
Now, the other one we have
is what's known as the Ping of Death.
The Ping of Death is a type of attack
that exploits a vulnerability
that existed in older,
unpatched systems where the attacker sends malformed
or oversized packets using the ICMP protocol.
Traditionally, the maximum size of an IP packet,
including its headers,
is limited to 65,535 bytes.
In the Ping of Death attack though,
the attacker crafts an ICMP Echo Request packet
or ping packet,
that's actually larger than this in size.
When the target system tries
to reassemble these oversized packets,
it can lead to buffer overflows,
system crashes,
or other unpredictable behavior
that usually results in a Denial of Service attack happening
on that victimized system.
Thankfully, for us though,
most modern operating systems
and network equipment are no longer vulnerable
to this type of an attack due to improved security measures
and patches that handle packet size correctly.
But it's still a term you'll hear out in the real world,
and so I wanted to make sure you understood
the concept behind a Ping of Death attack.
Now, because of these vulnerabilities
that have been exploited in the ICMP protocol,
many network administrators will actually choose
to block ICMP traffic
at their boundary firewalls and routers.
This can help to harden and secure the network,
but it does make troubleshooting
your network connectivity issues a little bit harder,
because you'll be unable
to use tools like ping and traceroute
to determine if network connectivity is working properly
because your firewall is going to drop your ICMP packets
or return a host unreachable error,
even if the host is powered on
and properly connected to your network,
because that ICMP traffic is being blocked
by your router or firewall.
So remember, the Internet Control Message Protocol
is a network diagnostic and error reporting tool,
not a transport protocol like TCP or UDP.
ICMP is encapsulated within the IP packets,
and it's essential for tasks like network troubleshooting
with tools like ping and traceroute.
Be aware, the ICMP Protocol does have some vulnerabilities
that have been exploited by attackers
such as using the protocol as part of an ICMP Flood Attack
or sending oversized ping packets
to create a Ping of Death on older legacy systems
and network infrastructure devices.