ExamFinch.com My Study

Study guide

2.3 ICMP Protocol, Network Diagnostics & Error Messages

Practice this exam

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

2.3 ICMP Protocol, Network Diagnostics & Error Messages

Key Takeaways Explain This Topic AI

ICMP operates as a Layer 3 companion protocol (IP Protocol 1) encapsulated directly inside IP datagrams, dedicated to error reporting and network diagnostics without transport port numbers.

ICMP error messages must include the entire original IP header plus at least the first 8 bytes of the original datagram payload to enable the sending host to correlate the error to an active socket.

Key ICMP types tested on CPSA include Type 0 (Echo Reply), Type 8 (Echo Request), Type 3 (Destination Unreachable, especially Code 3 Port Unreachable and Code 13 Administratively Filtered), and Type 11 (Time Exceeded).

Traceroute implementations differ: Windows tracert relies on ICMP Echo Requests (Type 8), whereas standard Unix traceroute transmits UDP datagrams to high ports (33434+) expecting ICMP Port Unreachable responses.

Last updated: September 2026

2.3 ICMP Protocol, Network Diagnostics & Error Messages

The Internet Control Message Protocol (ICMP) is an indispensable component of the Internet Protocol suite. While IP handles the forwarding of user data, ICMP provides the control and error-reporting mechanism across Layer 3. Security analysts must thoroughly understand ICMP message formats, diagnostic utilities, and firewall interaction rules. On the CREST CPSA examination, candidates are frequently assessed on specific ICMP Type/Code combinations, traceroute behavior differences across operating systems, Path MTU Discovery mechanics, and covert tunneling vectors.

1. ICMP Role & Architectural Rules

Defined for IPv4 in RFC 792 (and for IPv6 in RFC 4443 ), ICMP is fundamentally a Layer 3 companion protocol . It does not run over transport protocols like TCP or UDP; instead, ICMP messages are encapsulated directly within IPv4 datagrams carrying an IP Protocol number of 1 (or Protocol 58 for ICMPv6). +-----------------------+-----------------------+-----------------------+

  • | Layer 2 Frame Header | Layer 3 IPv4 Header | ICMP Message |
  • | (Ethernet) | (Protocol = 1) | (Type, Code, Payload) |
  • +-----------------------+-----------------------+-----------------------+
  • Non-Recursive Error Suppression Rules

To prevent network congestion and catastrophic packet storms, RFC 792 establishes strict restrictions governing when an ICMP error message can be emitted:

An ICMP error message must never be generated in response to another ICMP error message (it may, however, be generated in response to an ICMP query message, such as Echo Request).

An ICMP error message must never be sent in response to a datagram addressed to an IP broadcast or multicast address.

An ICMP error message must never be generated for a datagram sent as a link-layer broadcast (e.g., Ethernet FF:FF:FF:FF:FF:FF ).

An ICMP error message must never be generated for an IP fragment other than Fragment 0.

  • 2. ICMP Message Structure
  • All ICMP messages share a unified 4-byte base header , followed by a variable-length data payload: 0 1 2 3
  • 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  • +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  • | Type | Code | Checksum |
  • +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  • | Message-Specific Header Data |
  • +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  • | Data Payload |
  • +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type (8 bits): Specifies the overarching category of the ICMP message (e.g., Echo Request, Destination Unreachable, Time Exceeded).

Code (8 bits): Provides granular diagnostic context or the specific subtype within the designated Type.

Checksum (16 bits): 1's complement checksum covering the entire ICMP message (header and payload).

Message-Specific Data (32 bits):

For Query Messages (Echo Request/Reply): Contains a 16-bit Identifier and a 16-bit Sequence Number used by the client to match ping replies to specific outbound requests.

For Path MTU Discovery (Type 3, Code 4): Contains the 16-bit Next-Hop MTU value.

The Original Datagram Payload Requirement

When an intermediate router or receiving host generates an ICMP Error Message (such as Destination Unreachable or Time Exceeded), RFC 792 mandates that the message payload must include the entire original IPv4 header PLUS at least the first 8 bytes (64 bits) of the original datagram's payload .

Why the first 8 bytes? In TCP and UDP, the first 8 bytes of the transport payload contain the Source Port (bytes 0-1) and Destination Port (bytes 2-3), as well as the initial sequence numbers. By inspecting this embedded payload, the originating host's operating system kernel can immediately correlate the ICMP error back to the specific application socket and process that initiated the connection. +--------------------+---------------------+---------------------------------------+

  • | ICMP Error Header | Original IP Header | First 8 Bytes of Original L4 Payload |
  • | (Type, Code, Chk) | (20 bytes) | (Source Port, Dest Port, Seq Num) |
  • +--------------------+---------------------+---------------------------------------+
  • 3. Essential ICMP Types and Codes for CPSA

The following table outlines the critical ICMP Types and Codes assessed on the CREST CPSA examination: +-------+-------+-----------------------------------------------+-----------------------------------+

  • | Type | Code | Name / Description | Assessment & Reconnaissance Value |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 0 | 0 | Echo Reply | Target is alive (ping response). |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 3 | - | Destination Unreachable | Routing, host, port, or filter |
  • | | | | failure. |
  • | | 0 | - Network Unreachable | Routing table failure. |
  • | | 1 | - Host Unreachable | ARP resolution failure on subnet. |
  • | | 2 | - Protocol Unreachable | OS lacks L4 protocol handler. |
  • | | 3 | - Port Unreachable | Core of UDP port scanning (-sU). |
  • | | 4 | - Fragmentation Needed and DF Set | Path MTU Discovery (PMTUD). |
  • | | 9 | - Destination Network Prohibited | Administrative firewall ACL drop. |
  • | | 10 | - Destination Host Prohibited | Administrative firewall ACL drop. |
  • | | 13 | - Communication Administratively Prohibited | Explicit stateful firewall reject.|
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 5 | - | Redirect | Gateway route optimization. |
  • | | 0 | - Redirect for Network | Obsolete / insecure routing. |
  • | | 1 | - Redirect for Host | Exploited in ICMP MITM attacks. |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 8 | 0 | Echo Request | Standard ping probe. |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 11 | - | Time Exceeded | Hop limit reached or reassembly. |
  • | | 0 | - Time to Live Exceeded in Transit | Engine of traceroute. |
  • | | 1 | - Fragment Reassembly Time Exceeded | Host reassembly timeout expired. |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 12 | 0 | Parameter Problem: Bad IP Header | Pointer indicates invalid offset. |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 13 | 0 | Timestamp Request | Information disclosure: reveals |
  • | 14 | 0 | Timestamp Reply | target host system clock (UTC). |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • | 17 | 0 | Address Mask Request | Information disclosure: reveals |
  • | 18 | 0 | Address Mask Reply | target internal subnet mask. |
  • +-------+-------+-----------------------------------------------+-----------------------------------+
  • Security Implications of Specific Types

ICMP Redirect Attacks (Type 5): When a router detects that a host is sending traffic through it that could more efficiently reach another router on the same local subnet, it forwards the packet and sends an ICMP Type 5 (Redirect) to the sender. In an assessment scenario, an attacker on the local link can spoof ICMP Redirects to trick victim hosts into routing all gateway-bound traffic through the attacker's machine, executing a stealthy Man-in-the-Middle (MITM) attack. Modern secure operating systems ignore ICMP redirects by default.

ICMP Information Leakage (Types 13/14 and 17/18): Legacy systems responding to Timestamp Requests reveal their exact system clock in milliseconds past midnight UTC, aiding attackers in predicting time-based tokens or sequence numbers. Address Mask requests leak the internal subnet configuration.

Administrative Filtering (Type 3 Code 13): When a penetration tester sees Type 3 Code 13 returned in response to a scan, it confirms the presence of an active packet filter or stateful firewall (e.g., a Cisco router ACL configured with deny ... or an iptables rule utilizing -j REJECT --reject-with icmp-admin-prohibited ).

4. Network Diagnostic Utilities: Traceroute Mechanics

Traceroute maps the Layer 3 path across intermediate routers between a source host and a destination endpoint. A common CPSA examination question focuses on the architectural difference between the Microsoft Windows implementation and the standard Unix/Linux implementation .

Windows Implementation: tracert.exe

Uses ICMP Echo Request (Type 8, Code 0) packets exclusively.

Step 1: Sends an ICMP Echo Request with TTL = 1 \text{TTL} = 1 TTL = 1 .

Router 1 decrements TTL to 0, discards the packet, and returns ICMP Type 11 Code 0 (Time Exceeded in Transit) . tracert records the router's IP and round-trip time.

Step 2: Sends an ICMP Echo Request with TTL = 2 \text{TTL} = 2 TTL = 2 . Router 2 returns ICMP Type 11 Code 0.

Final Step: When the packet reaches the target endpoint with TTL = 1 \text{TTL} = 1 TTL = 1 , the destination host processes the packet normally and returns an ICMP Type 0 Code 0 (Echo Reply) . This informs tracert that the destination has been reached.

Unix / Linux Implementation: traceroute

By default, uses UDP datagrams directed to high, unallocated ports (starting at port 33434 and incrementing by 1 for each probe: 33434, 33435, 33436...).

Intermediate Hops: Identical to Windows: intermediate routers decrement TTL to 0 and return ICMP Type 11 Code 0 (Time Exceeded) .

Target Endpoint Behavior: When the UDP datagram reaches the ultimate destination, the host inspects the high destination port (e.g., 33440). Because no application is listening on that port, the destination host returns an ICMP Type 3 Code 3 (Port Unreachable) message! This error message signals to the Unix utility that the packet reached the target. Windows tracert: Probe: ICMP Type 8 (Echo Req) ===> Final Target Reply: ICMP Type 0 (Echo Reply)

Unix traceroute: Probe: UDP Port 33434+ ===> Final Target Reply: ICMP Type 3 Code 3 (Port Unreachable)

Alternative Modes: Modern Unix traceroute supports -I for ICMP mode (matching Windows) and -T for TCP SYN traceroute (typically directed to port 80 or 443), which allows analysts to trace routes through enterprise firewalls that block inbound UDP and ICMP.

5. Path MTU Discovery (PMTUD) & ICMP Black Holes

To maximize throughput, endpoints attempt to transmit the largest possible IP datagrams without undergoing router fragmentation.

PMTUD Mechanics (RFC 1191)

The sending host sets the Don't Fragment (DF) bit to 1 in the IPv4 header of all transmitted packets.

If a packet encounters an intermediate link whose Maximum Transmission Unit (MTU) is smaller than the datagram size (e.g., standard Ethernet MTU 1500 bytes entering a PPPoE or IPsec tunnel with MTU 1420 bytes), the router cannot fragment the packet.

The router drops the datagram and returns an ICMP Type 3, Code 4 message: "Destination Unreachable: Fragmentation Needed and DF Set" .

RFC 1191 specifies that the router includes the Next-Hop MTU value in bytes within the ICMP header.

The sending host reads the Next-Hop MTU and adjusts its Path MTU (and TCP MSS) downward accordingly.

The "ICMP Black Hole" Router Problem

Many network administrators mistakenly configure perimeter firewalls to blindly drop all incoming ICMP packets to prevent ping sweeps. When an intermediate router drops an oversized packet and attempts to send an ICMP Type 3 Code 4 notification, the firewall drops the ICMP message.

Symptoms:

The initial TCP 3-way handshake completes successfully because SYN and SYN-ACK segments are small (typically under 100 bytes).

Simple terminal commands (e.g., executing a short command in SSH or browsing a tiny HTML page) succeed.

As soon as the server transmits a bulk data response that fills a full 1500-byte MTU frame (e.g., an SCP file transfer, large web page, or SSL/TLS certificate exchange), the connection hangs indefinitely and times out without transferring data.

Mitigation: Allow ICMP Type 3 Code 4 at all network boundaries, or implement TCP MSS Clamping on intermediate routers ( iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu ).

6. ICMP Covert Channels & Tunneling

Because firewalls frequently permit outbound ICMP Echo Requests (Type 8) to allow internal administrators to ping external hosts, attackers exploit ICMP as an evasion and data exfiltration covert channel .

Tunneling Mechanics

Tools like ptunnel (Ping Tunnel) and icmpsh take advantage of the arbitrary data payload field of ICMP Echo Request and Echo Reply packets:

The attacker client encapsulates a full TCP stream, SSH session, or command-and-control (C2) shell inside the payload of outbound ICMP Type 8 Echo Requests.

The attacker's listening server on the internet intercepts the ping, extracts the nested protocol data, processes it, and returns the response encapsulated inside an inbound ICMP Type 0 Echo Reply. +-----------------------------------------------------------------------+

  • | Standard ICMP Ping Payload (Windows): "abcdefghijklmnopqrstuvwabcdefg" (32 bytes) |
  • +-----------------------------------------------------------------------+
  • | Covert Tunnel Payload: [Encrypted C2 Shell Traffic / SSH Stream] |
  • +-----------------------------------------------------------------------+
  • Detection & Analysis

Payload Size Anomalies: Standard OS ping utilities transmit fixed payloads (Windows uses 32 bytes; Linux uses 56 bytes). ICMP tunneling frames typically carry maximum-length payloads (e.g., 1000+ bytes).

High Entropy: Encrypted or compressed data inside ICMP payloads exhibits high Shannon entropy, contrasting with static plaintext alphabet patterns.

Frequency & Volume: A continuous stream of high-frequency ICMP traffic between a single workstation and an unfamiliar external IP address indicates tunneling.