ICMP their neighbors.

Also, hosts can discover and

learn about routers on their network, and
As discussed in Chapter 20, the IP provides routers can help a node redirect its messages.
unreliable and connectionless datagram Message Format
delivery. It was designed this way to make An ICMP message has an 8-byte header and a
efficient use of network resources. The IP variable-size data section. Although the
protocol is a best-effort delivery service that general format of the header is different for each
delivers a datagram from its original message type, the first 4 bytes are common
source to its final destination. However, it has to all. As Figure 21.8 shows, the first field, ICMP
two deficiencies: lack of error control and type, defines the type of the
lack of assistance mechanisms.
The IP protocol has no error-reporting or error-
correcting mechanism. What happens
if something goes wrong? What happens if a
router must discard a datagram because it
cannot find a router to the final destination, or
because the time-to-live field has a zero
value? What happens if the final destination host
must discard all fragments of a datagram
because it has not received all fragments within a
predetermined time limit? These are
examples of situations where an error has message. The code field specifies the reason for
occurred and the IP protocol has no built-in the particular message type. The last
mechanism to notify the original host. common field is the checksum field (to be
The IP protocol also lacks a mechanism for host discussed later in the chapter). The rest of the
and management queries. A host header is specific for each message type.
sometimes needs to determine if a router or The data section in error messages carries
another host is alive. And sometimes a network information for finding the original
administrator needs information from another packet that had the error. In query messages, the
host or router. data section carries extra information
The Internet Control Message Protocol (ICMP) based on the type of the query.
has been designed to compensate Error Reporting
for the above two deficiencies. It is a companion One of the main responsibilities of ICMP is to
to the IP protoco1. report errors. Although technology has
Types of Messages produced increasingly reliable transmission
ICMP messages are divided into two broad media, errors still exist and must be handled.
categories: error-reporting messages and IP, as discussed in Chapter 20, is an unreliable
query messages. protocol. This means that error checking
The error-reporting messages report problems and error control are not a concern of IP. ICMP
that a router or a host (destination) was designed, in part, to compensate for
may encounter when it processes an IP packet. this shortcoming. However, ICMP does not
The query messages, which occur in pairs, help a correct errors-it simply reports them. Error
host or a network manager get correction is left to the higher-level protocols.
specific information from a router or another Error messages are always sent to the original
host. For example, nodes can discover source because the only information available in
the datagram about the route is the
source and destination IP addresses. ICMP uses When a router cannot route a datagram or a host
the source IP address to send the error cannot deliver a datagram, the datagram
message to the source (originator) of the is discarded and the router or the host sends a
datagram. destination-unreachable message back to
the source host that initiated the datagram. Note
that destination-unreachable messages
Five types of errors are handled: destination can be created by either a router or the
unreachable, source quench, time destination host.
exceeded, parameter problems, and redirection Source Quench
(see Figure 21.9). The IP protocol is a connectionless protocol.
There is no communication between the
source host, which produces the datagram, the
routers, which forward it, and the destination
host, which processes it. One of the ramifications
of this absence of communication
is the lack offlow control. IP does not have a
flow control mechanism embedded in the
protocol. The lack of flow control can create a
major problem in the operation of IP:
The following are important points about ICMP congestion. The source host never knows if the
error messages: routers or the destination host has been
o No ICMP error message will be generated in overwhelmed with datagrams. The source host
response to a datagram carrying an never knows if it is producing datagrams
ICMP error message. faster than can be forwarded by routers or
D No ICMP error message will be generated for processed by the destination host.
a fragmented datagram that is not The lack of flow control can create congestion in
the first fragment. routers or the destination host.
D No IeMP error message will be generated for a A router or a host has a limited-size queue
datagram having a multicast (buffer) for incoming datagrams waiting to
address. be forwarded (in the case of a router) or to be
D No ICMP error message will be generated for processed (in the case of a host). If the
a datagram having a special address datagrams are received much faster than they can
such as 127.0.0.0 or 0.0.0.0. be forwarded or processed, the
queue may overflow. In this case, the router or
the host has no choice but to discard
some of the datagrams. The source-quench
message in ICMP was designed to add a
kind of flow control to the IP. When a router or
host discards a datagram due to congestion,
it sends a source-quench message to the sender
of the datagram. This message
has two purposes. First, it informs the source that
the datagram has been discarded.
Second, it warns the source that there is
congestion somewhere in the path and that the
Destination Unreachable
source should slow down (quench) the sending However, for efficiency, hosts do not take part in
process. the routing update process because
there are many more hosts in an internet than
routerS. Updating the routing tables of hosts
Time Exceeded dynamically produces unacceptable traffic. The
The time-exceeded message is generated in two hosts usually use static routing. When a
cases: As we see in Chapter 22, routers host comes up, its routing table has a limited
use routing tables to find the next hop (next number of entries. It usually knows the IP
router) that must receive the packet. If there address of only one router, the default router. For
are errors in one or more routing tables, a packet this reason, the host may send a datagram,
can travel in a loop or a cycle, going which is destined for another network, to the
from one router to the next or visiting a series of wrong router. In this case, the router
routers endlessly. As we saw in Chapter that receives the datagram will forward the
20, each datagram contains a field called time to datagram to the correct router. However, to
live that controls this situation. update the routing table of the host, it sends a
When a datagram visits a router, the value of this redirection message to the host. This concept
field is decremented by 1. When the of redirection is shown in Figure 21.11. Host A
time-to-live value reaches 0, after decrementing, wants to send a datagram to host B.
the router discards the datagram. However,
when the datagram is discarded, a time-exceeded
message must be sent by the
router to the original source. Second, a time-
exceeded message is also generated when
not all fragments that make up a message arrive
at the destination host within a certain
time limit.
Parameter Problem
Any ambiguity in the header part of a datagram
can Create serious problems as the datagram
travels through the Internet. If a router or the Router R2 is obviously the most efficient routing
destination host discovers an ambiguous choice, but host A did not choose
or missing value in any field of the datagram, it router R2. The datagram goes to R1 instead.
discards the datagram and sends a Router R1, after consulting its table, finds
parameter-problem message back to the source. that the packet should have gone to R2. It sends
Redirection the packet to R2 and, at the same time,
When a router needs to send a packet destined sends a redirection message to host A. Host A's
for another network, it must know the IP routing table can now be updated.
address of the next appropriate router. The same Query
is true if the sender is a host. Both routers In addition to error reporting, ICMP can
and hosts, then, must have a routing table to find diagnose some network problems. This is
the address of the router or the next accomplished through the query messages, a
router. Routers take part in the routing update group of four different pairs of messages,
process, as we will see in Chapter 22, and as shown in Figure 21.12. In this type of ICMP
are supposed to be updated constantly. Routing is message, a node sends a message that
dynamic. is answered in a specific format by the
destination node. A query message is
encapsulated
in an IP packet, which in tum is encapsulated in a
data link layer frame. However, in Timestamp Request and Reply
this case, no bytes of the original IP are included Two machines (hosts or routers) can use the
in the message, as shown in Figure 21.13. timestamp request and timestamp reply
messages to determine the round-trip time
needed for an IP datagram to travel between
them. It can also be used to synchronize the
clocks in two machines.
Address-Mask Request and Reply
A host may know its IP address, but it may not
know the corresponding mask. For
example, a host may know its IP address as
159.31.17.24, but it may not know that the
corresponding mask is /24. To obtain its mask, a
host sends an address-mask-request
message to a router on the LAN. If the host
knows the address of the router, it sends the
request directly to the router. If it does not know,
it broadcasts the message. The router
receiving the address-mask-request message
responds with an address-mask-reply
Echo Request and Reply message, providing the necessary mask for the
The echo-request and echo-reply messages are host. This can be applied to its full IP
designed for diagnostic purposes. Network address to get its subnet address.
managers and users utilize this pair of messages Router Solicitation and Advertisement
to identify network problems. The As we discussed in the redirection message
combination of echo-request and echo-reply section, a host that wants to send data to a host
messages detennines whether two systems on another network needs to know the address of
(hosts or routers) can communicate with each routers connected to its own network.
other. The echo-request and echo-reply Also, the host must know if the routers are alive
messages can be used to determine if there is and functioning. The router-solicitation
communication at the IP level. Because and router-advertisement messages can help in
ICMP messages are encapsulated in IP this situation. A host can broadcast (or
datagrams, the receipt of an echo-reply message multicast) a router-solicitation message. The
by the machine that sent the echo request is proof router or routers that receive the solicitation
that the IP protocols in the sender and message broadcast their routing information
receiver are communicating with each other using the router-advertisement message. A
using the IP datagram. Also, it is proof that router can also periodically send router-
the intermediate routers are receiving, advertisement messages even if no host has
processing, and forwarding IP datagrams. Today, solicited.
most systems provide a version of the ping Note that when a router sends out an
command that can create a series (instead of advertisement, it announces not only its own
just one) of echo-request and echo-reply presence but also the presence of all routers on
messages, providing statistical information. We the network of which it is aware.
will see the use of this program at the end of the Checksum
chapter.
In Chapter 10, we learned the concept and idea of a packet from the source to the destination.
of the checksum. In ICMP the checksum We have seen an application of the
is calculated over the entire message (header and traceroute program to simulate the loose source
data). route and strict source route options of
Example 21.2 an IP datagram in Chapter 20. We use this
Figure 21.14 shows an example of checksum program in conjunction with ICMP packets
calculation for a simple echo-request message. in this chapter. The program elegantly uses two
We ICMP messages, time exceeded and
randomly chose the identifier to be 1 and the destination unreachable, to find the route of a
sequence number to be 9. The message is divided packet. This is a program at the application
level that uses the services of UDP (see Chapter
23). Let us show the idea of the
traceroute program by using Figure 21.15.
Debugging Tools
There are several tools that can be used in the
Internet for debugging. We can determine
the viability of a host or router. We can trace the
route of a packet. We introduce two
tools that use ICMP for debugging: ping and
traceroute. We will introduce more tools
in future chapters after we have discussed the
corresponding protocols.
Ping
We can use the ping program to find if a host is
alive and responding. We use ping here
to see how it uses ICMP packets.
The source host sends ICMP echo-request Given the topology, we know that a packet from
messages (type: 8, code: 0); the destination, host A to host B travels through
if alive, responds with ICMP echo-reply routers Rl and R2. However, most of the time,
messages. The ping program sets the identifier we are not aware of this topology. There
field in the echo-request and echo-reply message could be several routes from A to B. The
and stans the sequence number traceroute program uses the ICMP messages
from 0; this number is incremented by 1 each and the TTL (time to live) field in the IP packet
time a new message is sent. Note that ping to find the route.
can calculate the round-trip time. It inserts the 1. The traceroute program uses the following
sending time in the data section of the steps to find the address of the router Rl
message. When the packet arrives, it subtracts and the round-trip time between host A and
the arrival time from the departure time to router Rl.
get the round-trip time (RTT). a. The traceroute application at hostA sends a
packet to destination Busing UDP;
the message is encapsulated in an IP packet with
Tracerollte a TTL value of 1. The program
notes the time the packet is sent.
The traceroute program in UNIX or tracert in b. Router Rl receives the packet and decrements
Windows can be used to trace the route the value of TTL to O. It then discards
the packet (because TTL is 0). The router,
however, sends a time-exceeded
ICMP message (type: 11, code: 0) to show that UDP header. The traceroute program records the
the TTL value is 0 and the packet destination address of the arrived
was discarded. IP datagram and makes note of the round-trip
c. The traceroute program receives the ICMP time. Receiving the destination unreachable
messages and uses the destination message with a code value 3 is an indication that
address of the IP packet encapsulating ICMP to the whole route has
find the IP address of router Rl. been found and there is no need to send more
The program also makes note of the time the packets.
packet has arrived. The difference
between this time and the time at step a is the
round-trip time.

The traceroute program repeats steps a to c three

times to get a better average
round-trip time. The first trip time may be much
longer than the second or third
because it takes time for the ARP program to
find the physical address of router
RI. For the second and third trips, ARP has the
address in its cache.
2. The traceroute program repeats the previous
steps to find the address of router R2
and the round-trip time between host A and
router R2. However, in this step, the
value of TTL is set to 2. So router RI forwards
the message, while router R2 discards
it and sends a time-exceeded ICMP message.
3. The traceroute program repeats step 2 to find
the address of host B and the round-trip
time between host A and host B. When host B
receives the packet, it decrements the
value of TIL, but it does not discard the message
since it has reached its final destination.
How can an ICMP message be sent back to host
A? The traceroute program
uses a different strategy here. The destination
port of the UDP packet is set to one
that is not supported by the UDP protocol. When
host B receives the packet, it cannot
find an application program to accept the
delivery. It discards the packet and sends an
ICMP destination-unreachable message (type: 3,
code: 3) to host A. Note that this
situation does not happen at router RI or R2
because a router does not check the
 member. IGMP helps the multicast router create
21.3 IGMP and update this list.
The IP protocol can be involved in two types of
communication: unicasting and multicasting.
Unicasting is the communication between one
sender and one receiver. It is a
one-to-one communication. However, some IGMP Messages
processes sometimes need to send the same IOMP has gone through two versions. We
message to a large number of receivers discuss IOMPv2, the current version. IOMPv2
simultaneously. This is called multicasting, has three types of messages: the query, the
which is a one-to-many communication. membership report, and the leave report.
Multicasting has many applications. For There are two types of query messages: general
example, and special (see Figure 21.16).
multiple stockbrokers can simultaneously be
informed of changes in a stock price,
or travel agents can be informed of a plane
cancellation. Some other applications include
distance learning and video-on-demand.
The Internet Group Management Protocol
(IGMP) is one of the necessary, but
not sufficient (as we will see), protocols that is
involved in multicasting. IGMP is a
companion to the IP protocol.

Group Management
For multicasting in the Internet we need routers
that are able to route multicast packets.
The routing tables of these routers must be Message Format
updated by using one of the multicasting Figure 21.17 shows the format of an IOMP
routing protocols that we discuss in Chapter 22. (version 2) message.
IGMP is not a multicasting routing protocol; it is
a protocol that manages group
membership. In any network, there are one or
more multicast routers that distribute
multicast packets to hosts or other routers. The
IGMP protocol gives the multicast routers
information about the membership status of hosts
(routers) connected to the network.
A multicast router may receive thousands of
multicast packets every day for different
groups. If a router has no knowledge about the
membership status of the hosts, it must Type. This 8-bit field defines the type of
broadcast all these packets. This creates a lot of message, as shown in Table 21.1. The value
traffic and consumes bandwidth. A better of the type is shown in both hexadecimal and
solution is to keep a list of groups in the network binary notation.
for which there is at least one loyal
 packets destined for that group. This means that
if there are three multicast routers
connected to a network, their lists of groupids are
mutually exclusive. For example, in
Figure 21.18 only router R distributes packets
with the multicast address of225.70.8.20.
A host or multicast router can have membership
in a group. When a host has membership,
Maximum Response Time. it means that one of its processes (an application
program) receives multicast packets
This 8-bit field defines the amount of time in from some group. When a router has
which a membership, it means that a network connected
query must be answered. The value is in tenths of to
a second; for example, if the value is 100, it one of its other interfaces receives these
means 10 s. The value is nonzero in the query multicast packets. We say that the host or the
message; it is set to router has an interest in the group. In both cases,
zero in the other two message types. We will see the host and the router keep a list of
its use shortly. groupids and relay their interest to the
D Checksum. This is a 16-bit field carrying the distributing router.
checksum. The checksum is calculated For example, in Figure 21.18, router R is the
over the 8-byte message. distributing router. There are two
D Group address. The value of this field is 0 for other multicast routers (R1 and R2) that,
a general query message. The value depending on the group list maintained by
defines the groupid (multicast address of the router R, could be the recipients of router R in
group) in the special query, the membership this network. Routers RI and R2 may be
report, and the leave report messages. distributors for some of these groups in other
networks, but not on this network.
Joining a Group
A host or a router can join a group. A host
IGMP Operation maintains a list of processes that have
IGMP operates locally. A multicast router membership
connected to a network has a list of multicast in a group. When a process wants to join a new
addresses of the groups with at least one loyal group, it sends its request to the host.
member in that network (see Figure 21.18).
The host adds the name of the process and the
name of the requested group to its list. If
this is the first entry for this particular group, the
host sends a membership report message.
If this is not the first entry, there is no need to
send the membership report since the
host is already a member of the group; it already
receives multicast packets for this group.
The protocol requires that the membership report
For each group, there is one router that has the be sent twice, one after the other
duty of distributing the multicast
within a few moments. In this way, if the first this message, the group address field is set to
one is lost or damaged, the second one 0.0.0.0. This means the query for membership
replaces it. continuation is for all groups in which a host is
involved, not just one.

Leaving a Group
The router expects an answer for each group in
When a host sees that no process is interested in its group list; even new groups may
a specific group, it sends a leave report. respond. The query message has a maximum
Similarly, when a router sees that none of the response time of 10 s (the value of the
networks connected to its interfaces is field is actually 100, but this is in tenths of a
interested in a specific group, it sends a leave second). When a host or router receives the
report about that group. general query message, it responds with a
However, when a multicast router receives a membership report if it is interested in a
leave report, it cannot immediately group. However, if there is a common interest
purge that group from its list because the report (two hosts, for example, are interested in
comes from just one host or router; the same group), only one response is sent for
there may be other hosts or routers that are still that group to prevent unnecessary traffic.
interested in that group. To make sure, This is called a delayed response. Note that the
the router sends a special query message and query message must be sent by only one router
inserts the groupid, or multicast address, (normally called the query router), also to
related to the group. The router allows a prevent unnecessary traffic. We discuss
specified time for any host or router to respond. this issue shortly.
If, during this time, no interest (membership
report) is received, the router assumes that
there are no loyal members in the network and
purges the group from its list. Delayed Response
To prevent unnecessary traffic, IGMP uses a
Monitoring Membership delayed response strategy. When a host or
router receives a query message, it does not
A host or router can join a group by sending a respond immediately; it delays the response.
membership report message. It can leave Each host or router uses a random number to
a group by sending a leave report message. create a timer, which expires between I and
However, sending these two types of reports lOs. The expiration time can be in steps of I s or
is not enough. Consider the situation in which less. A timer is set for each group in the
there is only one host interested in a list. For example, the timer for the first group
group, but the host is shut down or removed from may expire in 2 s, but the timer for the third
the system. The multicast router will group may expire in 5 s. Each host or router
never receive a leave report. How is this waits until its timer has expired before sending
handled? The multicast router is responsible a membership report message. During this
for monitoring all the hosts or routers in a LAN waiting time, if the timer of another host or
to see if they want to continue their router, for the same group, expires earlier, that
membership in a group. host or router sends a membership report.
The router periodically (by default, every 125 s) Because, as we will see shortly, the report is
sends a general query message. In broadcast, the waiting host or router receives
the report and knows that there is no need to send at the data link layer. What happens next depends
a duplicate report for this group; thus, on whether the underlying data link
the waiting station cancels its corresponding layer supports physical multicast addresses.
timer. Physical Multicast Support Most LANs support
physical multicast addressing. Ethernet
is one of them. An Ethernet physical address
Encapsulation (MAC address) is six octets (48 bits)
The IGMP message is encapsulated in an IP long. If the first 25 bits in an Ethernet address are
datagram, which is itself encapsulated in a 0000000100000000010111100, this
frame. See Figure 21.20. identifies a physical multicast address for the
TCP/IP protocol. The remaining 23 bits can
be used to define a group. To convert an IP
multicast address into an Ethernet address, the
multicast router extracts the least significant 23
bits of a class D IP address and inserts
them into a multicast Ethernet physical address
(see Figure 21.21).

Encapsulation at Network Layer

The value of the protocol field is 2 for the IGMP
protocol. Every IP packet carrying this
value in its protocol field has data delivered to
the IGMP protocol. When the message is
encapsulated in the IP datagram, the value of
TTL must be 1. This is required because
the domain of IGMP is the LAN. No IGMP
message must travel beyond the LAN. A
TTL value of 1 guarantees that the message does
not leave the LAN since this value is
decremented to 0 by the next router and,
consequently, the packet is discarded. Table 21.2 21.4 ICMPv6
shows the destination IP address for each type of We discussed 1Pv6 in Chapter 20. Another
message. protocol that has been modified in version 6 of
the TCPIIP protocol suite is ICMP (ICMPv6).
This new version follows the same strategy
Encapsulation at Data Link Layer and purposes of version 4. ICMPv4 has been
At the network layer, the IGMP message is modified to make it more suitable for IPv6.
encapsulated in an IP packet and is treated In addition, some protocols that were
as an IP packet. However, because the IP packet independent in version 4 are now part of
has a multicast IP address, the ARP Internetworking
protocol cannot find the corresponding MAC Control Message Protocol (ICMPv6). Figure
(physical) address to forward the packet 21.23 compares the network
layer of version 4 to version 6.
 Destination Unreachable
The ARP and IGMP protocols in version 4 are The concept of the destination-unreachable
combined in ICMPv6. The RARP message is exactly the same as described
protocol is dropped from the suite because it was for ICMP version 4.
rarely used and BOOTP has the same Packet Too Big
functionality. This is a new type of message added to version 6.
Just as in ICMPv4, we divide the ICMP If a router receives a datagram that is
messages into two categories. However, larger than the maximum transmission unit
each category has more types of messages than (MTU) size of the network through which
before. the datagram should pass, two things happen.
Error Reporting First, the router discards the datagram
As we saw in our discussion of version 4, one of and then an ICMP error packet-a packet-too-big
the main responsibilities of ICMP is to message-is sent to the source.
report errors. Five types of errors are handled: Time Exceeded
destination unreachable, packet too big, This message is similar to the one in version 4.
time exceeded, parameter problems, and Parameter Problem
redirection. ICMPv6 forms an error packet, This message is similar to its version 4
counterpart.
Redirection
which is then encapsulated in an IP datagram. The purpose of the redirection message is the
This is delivered to the original source of same as described for version 4.
the failed datagram. Table 21.3 compares the Query
error-reporting messages of ICMPv4 In addition to error reporting, ICMP can
with ICMPv6. The source-quench message is diagnose some network problems. This is
eliminated in version 6 because the priority accomplished through the query messages. Four
and the flow label fields allow the router to different groups of messages have been
control congestion and discard the least defined: echo request and reply, router
important messages. In this version, there is no solicitation and advertisement, neighbor
need to inform the sender to slow down. solicitation
The packet-too-big message is added because and advertisement, and group membership. Table
fragmentation is the responsibility of the 21.4 shows a comparison between the query
sender in IPv6. If the sender does not make the messages in versions 4 and 6. Two sets of query
right packet size decision, the router has messages are eliminated from
no choice but to drop the packet and send an ICMPv6: time-stamp request and reply- and
error message to the sender. address-mask request and reply. The timestamp
request and reply messages are eliminated
because they are implemented in other
protocols such as TCP and because they were
rarely used in the past. The address-mask
request and reply messages are eliminated in
IPv6 because the subnet section of an
address allows the subscriber to use up to 232 - 1
subnets. Therefore, subnet masking, as
defined in IPv4, is not needed here.

Echo Request and Reply

The idea and format of the echo request and
reply messages are the same as those in
version 4.
Router Solicitation and Advertisement
The idea behind the router-solicitation and -
advertisement messages is the same as in
version 4.
Neighbor Solicitation and Advertisement
As previously mentioned, the network layer in
version 4 contains an independent protocol
called Address Resolution Protocol (ARP). In
version 6, this protocol is eliminated, and
its duties are included in ICMPv6. The idea is
exactly the same, but the format of the
message has changed.
Group Membership
As previously mentioned, the network layer in
version 4 contains an independent protocol
called IGMP. In version 6, this protocol is
eliminated, and its duties are included in
ICMPv6. The purpose is exactly the same.