Errors, Information, and the Quoted Packet
Reading an ICMP message as evidence rather than as noise
Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.
What you'll be able to do
- ▸Separate ICMP's informational messages from its error messages
- ▸Explain why an error carries a copy of the packet that caused it
- ▸Say why ICMP error delivery is not guaranteed and what that means for diagnosis
Before this lesson — it builds directly on:
IP forwards packets and makes no promises. When it cannot forward one it has two options: discard it silently, or discard it and tell somebody.
ICMP is the second option. It is not a layer above IP and not a transport — it is IP's own reporting channel, carried inside IP packets, and it exists because a network that fails silently is a network nobody can diagnose.
The reports are the important part. Ping is the famous message and it is the least interesting one.
Watch these fields in the lab: icmp.type · icmp.code
- Type
- The family of message. 8 and 0 are echo request and reply; 3 is destination unreachable; 11 is time exceeded; 12 is parameter problem.
- Code
- The specific reason within a type. Under type 3, code 0 is network unreachable, code 1 host unreachable, code 3 port unreachable, code 4 fragmentation needed.
- Quoted packet
- The copy of the offending IP header and the first bytes of its payload that every error carries, so the sender can tell which conversation the report concerns.
Watch these fields in the lab: icmp.type · icmp.code
✓ Concept check — before you open the packets
These test the idea, not the trace. You should be able to answer them from the explanation above.
Now that you understand the concept, observe how it appears in the packet exchange.
The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.