What Is ICMP?

Ping

Ping is the most common debugging method to detect whether IPv4/IPv6 network devices are reachable. It uses ICMP echo messages to test the following:

• Reachability of a remote device
• Round-trip delay in communicating with the remote host
• Whether packets are lost

Tracert

Tracert checks network connectivity by checking the path of packets from the source to the destination. When a network fault occurs, you can use tracert to locate the fault.

Tracert determines the routes from a host to other hosts on the network based on ICMP timeout messages and destination unreachable messages. In addition, it helps determine the delay of each hop on the IP network. The delay indicates the time required for sending a packet from the information source to the destination. The delay can be classified into propagation delay, transmission delay, processing delay, and queuing delay.

NQA

NQA is a technology that measures network performance in real time and collects statistics on network information, such as the delay, jitter, and packet loss rate. It helps learn network service quality in real time and effectively diagnoses and locates network faults.

NQA extends and enhances the ping and tracert functions by using different types of ICMP messages. It can accurately test the network operating status and output statistics. NQA tests include ICMP tests, ICMP jitter tests, and trace tests.

• ICMP test

  In an ICMP test, ICMP Echo Request and Echo Response messages are sent to test the destination reachability and calculate the network response time and packet loss rate. The test result clearly reflects the network performance and connectivity. The ICMP test functions similarly to the ping command. The difference is that the ICMP test can provide detailed output information.

• ICMP jitter test

  An ICMP jitter test calculates the delay, jitter, and packet loss rate using timestamps carried in ICMP messages. Jitter is calculated by subtracting the interval for sending two consecutive messages from the interval for receiving the two messages.

• Trace test

  An NQA trace test monitors the forwarding path from a source to a destination and collects statistics such as delay about each device along the path. The trace test functions similarly to the tracert command. The difference is that the trace test can provide detailed output information. Information about each hop includes the average delay, packet loss rate, and time when the last packet is received.

ICMP Attacks

Currently, most ICMP attacks are denial of service (DoS) attacks. The most common ICMP flood attack occurs when an attacker sends a large number of forged ICMP packets to the target device in a short period of time. As a result, the target device is busy with processing these useless packets and cannot provide services for legitimate users. The following figure shows the process.

ICMP flood attack

ICMP flood attacks are classified into bandwidth-consuming DoS attacks and port scanning attacks (connection-based DoS attacks).

• Bandwidth-consuming DoS attack

  An attacker sends a large number of forged ICMP Echo Request packets. The CPUs of network devices, such as switches and routers, need to respond to these packets, occupying a large amount of bandwidth and CPU resources. This DoS attack, like other DoS attacks, consumes a large number of device resources and makes the devices unable to provide normal services.

  ICMP Echo Reply messages have a higher priority. In most cases, internal hosts are allowed to use the ping command. Such attacks target only the network bandwidth and can be initiated by a single attacker. More severe attacks, such as smurf attacks, can enable hosts on the entire subnet to attack the target host, increasing ICMP traffic.

• Port scanning attack (connection-based DoS attack)

  A port scanning attack occurs when an attacker sends a large number of port scanning packets to a switch. The switch needs to respond with a large number of ICMP destination unreachable messages, consuming system resources and allowing the attacker to easily access the ports enabled on the switch. Then the attacker can attack these ports, affecting network connections of all IP devices.

In addition, there are DoS attacks targeting hosts, which are also called ping-of-death attacks. These DoS attacks mainly exploit operating system vulnerabilities.

In the early stage, routers limit the maximum size of packets. Many operating systems specify 64 KB as the maximum size of an ICMP message in the TCP/IP protocol stack. After the header of an ICMP message is read, a buffer is generated for the payload based on the information contained in the header. When receiving a malformed packet whose size is claimed to exceed the maximum size of an ICMP message, that is, 64 KB, a device will allocate a payload of more than 64 KB, leading to a memory allocation error. As a result, the TCP/IP protocol stack crashes and the device breaks down.

According to this, an attacker can send an invalid ICMP Echo Request packet to crash or restart the target system. Many systems, including Windows, Unix, Macintosh, and some switches, routers, and printers, are vulnerable to such attacks. If the version of the operating system used by the user is outdated, ensure that required patches are installed.

ICMP Attack Defense

ICMP plays a significant role in network data transmission, network management and monitoring, and network security. Therefore, the ICMP attack defense technology is of great importance to reduce the burden of the device in processing ICMP packets and defend against ICMP attacks. Currently, ICMP packet rate limiting, ICMP packet validity check, discarding ICMP packets that do not need to be processed, and no response to unreachable packets are used to defend against attacks and protect device CPU resources.

• Rate limiting

  ICMP packet rate limiting includes port-based rate limiting, VLAN-based rate limiting, and global rate limiting. In addition, chip-based rate limiting is implemented to defend against ICMP flood attacks.

• Validity check and discarding of packets that do not need to be processed

  Invalid ICMP packets, such as the packets whose TTL is 0 and ICMP types are 15, 16, or 17 are discarded directly. You can also configure the function of discarding the ICMP packets that are seldom used, including the ICMP packets whose TTL is 1, ICMP packets with options, and ICMP unreachable packets.

• No response to unreachable packets

  When a user sends a large number of Destination Port Unreachable or Destination Network Unreachable packets to attack a device, the device discards these packets without responding to them to protect CPU resources.