Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just read this in Wikipedia:

Although ICMP messages are contained within standard IP datagrams, ICMP messages are usually processed as a special case, distinguished from normal IP processing, rather than processed as a normal sub-protocol of IP.

How is ICMP unique? I tried to find out whether it's being used in a TCP packet or a UDP packet when running ping, but I kept reading that it's a "unique" protocol and couldn't find a definite answer for this.

Also, I saw this question and answer in a Wireshark Lab about ICMP - ping:

If ICMP sent UDP packets instead (as in Unix/Linux), would the IP protocol number still be 01 for the probe packets? If not, what would it be?

No. If ICMP sent UDP packets instead, the IP protocol number should be 0x11.

Why would the IP protocol number be different if ICMP sent UDP packets?
Also, doesn't ICMP use UDP anyway? How does that work?

share|improve this question
TCP, UDP and ICMP are all different families. None uses the other. Yet they all cooperate. – Hennes Nov 22 '12 at 14:18
@Hennes But it runs in the Internet Layer which is under the Transport Layer, so how is it parallel to TCP and UDP? – tempy Nov 22 '12 at 14:20
The ‘internet layer’ is IP, which described packages sent from IP addresses to other IP addresses. You can then run TCP or UDP over IP to not only route packages from IP to IP, but also add a second ‘dimension’, ports. These are usually associated with the ‘transport layer’. But if you only want to send packages from Host A to Host B without any additional information, you don't need TCP or UDP and can just use IP. This is done by ICMP, which uses the IP layer provided by IP, but not the transport layer offered by TCP/UDP. – Claudius Nov 22 '12 at 14:24
All three run on usually on top of IP. Which is why "TCP/IP" is a bad name. It should be "TCP/UDP/ICMP family" and "IP". The same short naming it also used elsewhere. E.g. "IPX/SPX" which should be "IPX" and "SPX". When you look at them at different layers it get clearer. – Hennes Nov 22 '12 at 14:24
You can ‘tunnel’ ICMP over UDP, in which case the protocol number of the protocol running directly atop of IP would be 0x11, the protocol number of UDP. So normally one has IP < ICMP or IP < UDP or IP < TCP, but if you use UDP for ICMP, you have IP < UDP < ICMP~. – Claudius Nov 22 '12 at 14:32
up vote 6 down vote accepted

How is ICMP unique? I tried to find out whether it is being used in a TCP packet or a UDP packet when running ping, but I kept reading that it's a "unique" protocol and couldn't find a definite answer for this.

It is not being used in either a TCP or UDP datagram.

Instead look at it like this:

IP is an envelope. Transmissions happens when someone hands me a paper and tells me where it has to go. I put the paper in an envelope, write the destination on it and put it in mail out. Receiving is the other way around. An envelope arrives in post-in, I get it out of the envelope and hand it to the next person.

Note that I do not care how the postal part works. There could be some guy in a postal uniform. It could be a dedicated drivers. Someone could take the envelopes and tie them to carrier pidgeons. All I care about is getting paper into and out of envelopes.

Those papers come in several formats.

  • One of them is just a plain paper with text. (UDP).
  • One of them us a type of paper with a tracking numbers (think: in reference to your request, here is part 2 of .... etc etc) (TCP)
  • One of them is not a letter with text but with status messages (ICMP)

Each of the paper has a small marking in the corner. These markings are different for all three kinds (that is probably your unique)

If it is a marked UDP (17, or 0x11) the paper will be laid out like this:


If the marking in the corner has the sign/value of TCP (0x06) then I know the paper will be laid out like this:


If I have a ICMP datagram (0x01) I know the layout will be yet a bit different.

But in all cases I can check one specific place (same place in all pieces of paper) and read one value. Based on that I know how the layout of the rest of the paper.

All of these values are unique per paper layout

share|improve this answer
Thank you for the explanation; one thing though - how is ICMP just like TCP and UDP (runs above IP) yet it's on the same layer as IP (moreover, it's called a sub-protocol of the IP protocol)? Are there other cases like this? – tempy Nov 22 '12 at 15:18
TCP, UDP, and ICMP are all protocols that run on top of IP. ICMP is more closely tied to IP than the others. IPv6 has a corresponding ICMPv6, which is different from IPv4 and the original ICMP, but TCP & UDP aren't dependent on the IP version. IP is a Internet-layer protocol, TCP/UDP/ICMP are all transport-layer protocols. – Mike Larsen Nov 22 '12 at 18:54
@MikeLarsen But according to Wikipedia ICMP is an Internet-layer protocol and not a Transport-layer protocol. – tempy Nov 22 '12 at 19:54
In name, yes, because it's tied to the IP version, and is used for some types of notifications. However, like a Transport-layer protocol, it has its own set of headers and a protocol number. see the ICMP article for details. – Mike Larsen Dec 4 '12 at 22:47
Some protocols don't fit neatly into any of the OSI levels. ICMP is one of them. MPLS is another. – LawrenceC Apr 16 '13 at 11:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.