ICMP is actually a user of the IP protocol--in other words, ICMP messages must be encapsulated within IP packets. However, ICMP is implemented as part of the IP layer. So ICMP processing can be viewed as occurring parallel to, or as part of, IP processing. Therefore, in the topic on TCP/IP-based layered network, ICMP is shown as a layer 3 protocol.

ICMP is probably most well known as the message protocol used for the ping command. A ping command sends an ICMP echo request to the target host. The target host responds with an echo reply. The ping command is losing some of its usefulness in today's more security-conscious networks: many routers disable responses to echo requests.

ICMP's primary use on a network is to deliver information about simple problems with the delivery of packets. For example, ICMP can inform hosts about:

• Maximum transmission unit limitations. When a packet that is too large for a network to handle arrives at a router, the router will break it into smaller packets (fragments).

  If the packet has a flag (an IP flag, in fact) stipulating the packet cannot be fragmented, then the router will discard the packet and send an ICMP fragmentation needed packet back to the original sender.

• Packet expiry. The time exceeded after a packet has traversed too many hops.
• Destination unreachable. For example, when an ARP broadcast fails to elicit a matching IP address.
• Routing problems. When a host believes a better route exists.

  Note that this is not a desirable feature of ICMP and should be disabled under almost all circumstances. Routing protocols do a better job of determining the best route.

ICMP is defined in RFC 792.