skip to content

ICMP messages ride inside IP packets just as TCP segments do, so why is ICMP placed at the network layer rather than the transport layer?

level: middleimportance: should knowfreq 42%

answer

  1. who the messages are about
  2. no ports, no process
  3. integral part of IP
  4. errors quote the original header

basics

~10 s

ICMP reports on IP delivery itself, is often generated by routers, and has no ports or process-to-process service. RFC 1122 calls it an integral part of IP even though it is carried inside IP.

solid answer

~40 s

Because layers are decided by job, not by nesting. RFC 1122 says ICMP "is considered to be an integral part of IP, although it is architecturally layered upon IP". Its messages are about IP delivery: **Destination Unreachable**, **Time Exceeded**, **Redirect** and **Parameter Problem** errors, plus queries such as **Echo**. Many are generated by routers, which never run a transport for the traffic they forward. ICMP has **no port numbers** and offers applications no delivery service, which is what defines layer 4. An IPv4 ICMP error quotes the IP header and at least the first 8 data octets of the failed datagram, and the receiving host uses the quoted protocol number to hand the error up to the right transport. So ICMP serves IP and the transports above it.

go deeper

for a junior

Know that ICMP sits at layer 3 with IP and that ping uses ICMP Echo. Be ready to say ICMP has no ports.

for a middle

Explain why nesting inside IP does not make ICMP a transport: it reports on IP delivery, routers often generate it, and errors quote the original header so hosts can notify the right transport.

for a senior

Turn placement into diagnosis: a working ping proves layer 3 only, and filtering all ICMP removes IP's error channel. Use that when triaging a service that is reachable but not answering.

for a principal

Use ICMP to argue that 'upper layer' in a specification is about header order while layer placement is about responsibility, and keep the two apart in design reviews.

## The puzzle On the wire, an ICMP message looks like a transport segment: an IP header, then an ICMP header, then data. For IPv6 the chain is explicit, since the IPv6 **Next Header** value 58 identifies ICMPv6 (RFC 8200 §8.1). RFC 8200's terminology even lists "control protocols such as ICMP" as an **upper layer**, meaning "a protocol layer immediately above IPv6", in the same sentence as TCP and UDP. Yet the usual textbook answer, and RFC 1122, place ICMP in the **internet (network) layer**. The two statements are consistent once you separate *header nesting* from *function*. ## What RFC 1122 says RFC 1122 §1.1.3, describing the internet layer: > ICMP is a control protocol that is considered to be an integral part of IP, although it is architecturally layered upon IP, i.e., it uses IP to carry its data end-to-end just as a transport protocol like TCP or UDP does. The same section lists "the Internet layer protocols IP, ICMP, and IGMP". So the specification acknowledges the nesting and still assigns ICMP to the internet layer. ## Why function puts it at layer 3 - **It talks about IP.** ICMP error messages report problems delivering IP datagrams. RFC 1122 §3.2.2 groups them as Destination Unreachable, Redirect, Source Quench, Time Exceeded and Parameter Problem, with Echo, Information, Timestamp and Address Mask as query messages. - **Routers generate many of the errors.** A router sends a **Time Exceeded** message with code 0 when a datagram's TTL runs out in transit (RFC 1122 §3.2.2.4). Routers do not run TCP or UDP on behalf of the traffic they forward, so ICMP has to live at the layer routers do run. - **It has no ports.** ICMP messages are identified by **type** and **code**, not by port numbers. It gives applications no multiplexing, reliability or stream service, and those services are the definition of layer 4. - **It is plumbing between layers.** Every ICMP error "includes the Internet header and at least the first 8 data octets of the datagram that triggered the error" (RFC 1122 §3.2.2). The receiving host's internet layer extracts the IP protocol number from that quoted header "to select the appropriate transport protocol entity to handle the error". ICMP carries news *up* to the transports; it is not one of them. Hosts generate some ICMP too, for example **Port Unreachable** (code 3) when UDP cannot deliver a datagram to any listening process (RFC 1122 §3.2.2.1). Even then, the message reports on the delivery of an IP datagram rather than carrying application data. ## Nesting versus function, side by side | Question | TCP | ICMP | |---|---|---| | Carried inside an IP datagram? | yes | yes | | Uses port numbers? | yes | no (type and code) | | Provides a service to applications? | reliable byte stream | none | | Who generates it? | end hosts only | routers and hosts | | What it is about | application data | IP delivery itself | | Placement | transport (layer 4) | internet / network (layer 3) | ## IGMP follows the same logic RFC 1122 names a third internet-layer protocol: **IGMP**, "used for establishing dynamic host groups for IP multicasting". Like ICMP, it is carried inside IP datagrams, has no ports and serves IP rather than applications, so it is placed at the internet layer for the same reasons. Seeing that the argument generalises is a good sign you are reasoning from function rather than from a memorised list. ## What the placement means in practice 1. **Ping tests layer 3.** An ICMP Echo that is answered proves that IP datagrams reach the host and come back. It proves nothing about a TCP or UDP port, a service or an application. 2. **Blocking all ICMP damages IP.** Because ICMP is how IP reports trouble, a firewall that drops every ICMP message also drops the errors that path MTU discovery and transport error handling depend on (the mechanics belong to IP). 3. **Transports react to ICMP.** RFC 1122 requires Destination Unreachable and Time Exceeded messages to be passed to the transport layer, which then decides what to do. ## How to answer State the RFC 1122 wording, give two functional reasons (no ports, router-generated reports about IP delivery), and explain that "upper layer" in RFC 8200 describes header nesting, while the OSI placement describes the job.

  • A ping to a server succeeds but its web service times out. What has the ping actually proven?
    Only layer 3 reachability: ICMP Echo requests reached the host's IP stack and Echo Replies came back. ICMP has no ports, so the result says nothing about whether the TCP port is listening, whether a firewall filters it, or whether the application is healthy.
  • RFC 8200 calls ICMP an upper-layer protocol relative to IPv6. Does that contradict placing it at layer 3?
    No. RFC 8200 uses 'upper layer' for anything whose header follows the IPv6 header, which also includes OSPF and tunnelled IPv6 itself. That is header nesting. OSI placement is about function, and ICMP's function is reporting on IP delivery.

saying these in an interview costs you the question

  • ICMP is a transport protocol because it is carried inside IP like TCP.
  • A successful ping proves the server's TCP port is open.
  • ICMP uses port numbers to reach the right application.
  • Blocking all ICMP is harmless because only ping uses it.
  • Only end hosts ever generate ICMP messages.