PROTOCOLS-FUN . PACKET ANATOMY

ICMPv4 Anatomy

RFC 792 (1981)
rev 2026.08
header 4 bytes + type-specific
checksum message only, no pseudo-header
type 4 deprecated 2012

RFC 792 (1981) - errors and diagnostics for IPv4: unreachable destinations, exceeded hop limits, and the Echo Request/Reply pair everyone calls ping. The checksum here is a genuine contrast with ipv6-fun's ICMPv6: ICMPv4 has no pseudo-header at all - the checksum covers only the ICMP message itself, never the source/destination IP addresses. ICMPv6 added the pseudo-header specifically to close a spoofing/misdelivery gap ICMPv4 never addressed. Hover a field to light its bytes, click a field marked + for its lookup table.

headertype+code+checksum, 4 bytesspecRFC 792

Every ICMPv4 message opens with the same 4 bytes; the type field alone tells a receiver which of roughly a dozen message shapes follows.

generic header (4 bytes)

Checksum shown as a placeholder here since a real one needs a full message body - see the other tabs for worked examples.

type8 (request) / 0 (reply)size8 bytes + payload

What every ping command actually sends. Identifier and sequence let a sender match replies to requests when several pings are in flight at once; the payload is arbitrary and usually just a byte-counting pattern.

Echo Request (16 bytes: 8-byte header + 8-byte payload)

A reply is byte-identical except type=0 and the checksum recomputed for that type change.

type3codes0-15size8 bytes fixed

One type, sixteen meanings via the code field. Code 4 is the one with real teeth: "fragmentation needed but the Don't Fragment bit was set" - the message that drives IPv4 Path MTU Discovery, carrying the next hop's MTU in what would otherwise be unused bytes (RFC 1191).

Destination Unreachable, code 4 (8 bytes)

A router telling the sender: your packet needed fragmenting, DF was set, so I dropped it - retry at 1480 bytes instead.

type11code0 (TTL) or 1 (reassembly)size8 bytes fixed

Sent when TTL hits zero in transit (code 0) or a fragment reassembly timer expires before all fragments arrive (code 1). Code 0 from every router along a path, one hop-count at a time, is literally what traceroute is built out of.

Time Exceeded, code 0 (8 bytes)
type4statusdeprecated, RFC 6633 (2012)size8 bytes fixed

In 1981, this was IP's only congestion-control signal: a router sends Source Quench to tell a sender "slow down." Same byte shape as Time Exceeded - the interesting part is entirely what happened to it, not what's in it.

Source Quench, historical (8 bytes)
deprecated, not just unused. RFC 6633 (2012) doesn't just note that Source Quench fell out of favor - it mandates active rejection: hosts "MUST NOT send" it, and TCP/UDP/SCTP/DCCP implementations "MUST silently discard" any they receive. Major stacks had already stopped honoring it years earlier; the RFC formalized what was already true in practice. Its replacement for congestion signaling isn't a new ICMP message at all - it's ECN, a couple of repurposed bits in the TCP/IP header itself. See the TCP anatomy page's Flags: 2001+ tab.