This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

icmp code 0 means unreachable ?

0

Does icmp code 0 means the destination is unreachable ?

I was also reading it would need type to be value of 11 to means TTL exceeded too but I see all are type 8.

alt text

asked 27 Dec '16, 11:24

doran_lum's gravatar image

doran_lum
11111116
accept rate: 0%

edited 28 Dec '16, 13:22

grahamb's gravatar image

grahamb ♦
19.8k330206


2 Answers:

2

You have to look not only on the 'code' value along, but to combination 'type + code'. Only both values together have a meaning.

Pls take a look at RFC 792 where all these combinations are listed. It is clearly seen there that " ICMP type 8; code 0" means 'ICMP echo request message' (as Wireshark correctly decoded it for you in the Info column).

answered 27 Dec '16, 12:49

Packet_vlad's gravatar image

Packet_vlad
4361613
accept rate: 20%

edited 29 Dec '16, 07:35

Jaap's gravatar image

Jaap ♦
11.7k16101

1

Look at the Type first, then the Code. The Destination Unreachable ICMP messages are all Type 3. You can think of the Code value as sub-type. A Type 3, Code 0 message is Network Unreachable; Type 3, Code 1 is Host Unreachable, and so on. There are many different Type 3, Destination Unreachable, messages.

A Type 11 is Time Exceeded. Not necessarily TTL exceeded. Type 11, Code 0 means Time to Live Exceeded in Transit, which does mean that the TTL got down to 0; but a Type 11, Code 1 means Fragment Reassembly Timer Exceeded, which doesn't depend on the TTL.

Please refer to the RFC that Packet_vlad gave above.

You only see Type 8 because that's all that's there.

answered 28 Dec '16, 16:57

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%