IP and ICMP Explained: Ping, TTL, Traceroute & Ping Sweeps (Animated)

IP (Internet Protocol) gives every device an address and moves packets hop by hop across routers. ICMP is its helper protocol for errors and diagnostics: it powers ping and traceroute. Attackers use the same tools to map a network before attacking it.

1. Ping: is that host alive?

Ping sends an ICMP echo request and waits for an echo reply. Every router on the way reduces the packet’s TTL by 1.

1. ECHO REQUEST (Your laptop → Web server): The IP header carries source, destination and TTL=64. The ICMP part says type 8: “please answer”.
2. ECHO REPLY (Web server → Your laptop): The server answers with type 0. Ping prints the round-trip time: 18 ms.

Wireshark filter:

icmp

2. Ttl & traceroute: finding every router on the path

Traceroute sends packets with TTL 1, 2, 3… Each router that reduces TTL to 0 drops the packet and sends back an ICMP time exceeded error, revealing itself.

1. PROBE (Your laptop → Web server): TTL is only 1, so the first router reduces it to 0 and must drop the packet.
2. TIME EXCEEDED (Router → Your laptop): The router reports the error, and by doing so tells us its address: hop 1.
3. PROBE (Your laptop → Web server): Next probe: TTL=2 survives the first router and dies at the next one, inside the internet.
4. TIME EXCEEDED (Internet → Your laptop): Hop 2 reveals itself. Repeat with TTL 3, 4, 5… until the destination answers, and you have the whole path.

Wireshark filter:

icmp.type == 11

3. Ping sweep: attack: mapping live hosts

Before attacking, an intruder needs to know which addresses are alive. A ping sweep sends echo requests to every address in a range and notes who replies.

1. ECHO REQUEST (Attacker → Your laptop): One command pings the whole subnet in seconds.
2. ECHO REPLY (Your laptop → Attacker): Your laptop politely replies and lands on the attacker’s target list. Next step would be a port scan.

Wireshark filter:

icmp.type == 8 && ip.src == 192.168.1.66

4. Filter icmp: defence: answer only who you must

Host firewalls can ignore echo requests from untrusted networks, and intrusion detection flags one source pinging many addresses. Keep the ICMP errors that networks need, such as “fragmentation needed”.

1. ECHO REQUEST (Attacker → Your laptop): The firewall drops the probes, so the laptop stays invisible to a simple sweep. (Attackers then try ARP or TCP probes, which is why layered defence matters.)

Try it (linux):

sudo ufw default deny incoming
nmap -sn 192.168.1.0/24   (see what answers)

FAQ