ICMP Type & Code Reference

ICMP — the Internet Control Message Protocol — carries the diagnostic and error messages that make IP usable: ping, traceroute, “destination unreachable”, “packet too big” and IPv6 Neighbor Discovery all ride on it. Each message is identified by a type and, within many types, a code. This reference lets you search both the ICMPv4 (RFC 792) and ICMPv6 (RFC 4443) registries and explains what each pair means in practice.

How it works

An ICMP message header begins with an 8-bit type and an 8-bit code. The type names the broad message class (Echo Request, Destination Unreachable, Time Exceeded) and the code refines it (e.g. unreachable because of network, host, port or fragmentation-needed). ICMPv4 and ICMPv6 use overlapping numbers for different meanings, so the version always matters — type 3 is Destination Unreachable in IPv4 but Time Exceeded in IPv6.

Use the search box for a number or keyword and the version selector to scope results to the stack you are debugging.

High-value type/code pairs to know

v4 type 8  / 0   Echo Request  (ping out)
v4 type 0  / 0   Echo Reply    (ping back)
v4 type 3  / 0   Net Unreachable
v4 type 3  / 1   Host Unreachable
v4 type 3  / 3   Port Unreachable  (UDP probe used by traceroute target)
v4 type 3  / 4   Frag needed, DF set -> Path MTU Discovery signal
v4 type 11 / 0   TTL exceeded in transit -> each traceroute hop
v4 type 11 / 1   Fragment reassembly time exceeded
v6 type 1  / 0   No route to destination
v6 type 2  / 0   Packet Too Big -> IPv6 PMTU (NEVER firewall this)
v6 type 3  / 0   Hop Limit Exceeded -> each IPv6 traceroute hop
v6 type 128/ 0   Echo Request (IPv6 ping out)
v6 type 129/ 0   Echo Reply   (IPv6 ping back)
v6 type 133/134  Router Solicitation / Advertisement (SLAAC)
v6 type 135/136  Neighbor Solicitation / Advertisement (IPv6 ARP)

Diagnosing common problems with ICMP

Path MTU black holes

When a connection works for small packets but stalls on large ones (for example a TCP handshake completes but file transfers hang), the cause is almost always a firewall dropping ICMP type 3 code 4 (IPv4) or type 2 (IPv6). These messages tell the sender that a packet was too large to transit a link and must be fragmented. Without them, the sender never learns the effective MTU and keeps retransmitting oversized packets. The fix is to permit these specific types inbound on your firewall rather than blocking all ICMP.

IPv6 autoconfiguration failures

IPv6 hosts use ICMP extensively for address management through Neighbor Discovery Protocol (NDP). If hosts cannot get addresses or cannot communicate on an IPv6 segment, check that the following are not blocked on the local link:

• Types 133/134 — Router Solicitation and Advertisement (needed for SLAAC and default gateway discovery)
• Types 135/136 — Neighbor Solicitation and Advertisement (needed for address resolution, the IPv6 equivalent of ARP)
• Type 137 — Redirect (optional but used for route optimisation)

Traceroute interpretation

Traceroute works by sending packets with incrementing TTL (or Hop Limit in IPv6). Each router that decrements the value to zero returns ICMP Time Exceeded (v4 type 11, v6 type 3). The destination returns either Port Unreachable (v4 type 3 code 3, for UDP probes) or an Echo Reply (v4 type 0, for ICMP probes) when the probe arrives. A * * * in traceroute output means a hop dropped or rate-limited the ICMP response — not necessarily that the path is broken.

ICMPv4 versus ICMPv6: numbering differences

ICMPv4 and ICMPv6 are separate protocols with entirely separate type numbering, defined by RFC 792 and RFC 4443 respectively. A type number means different things in each version. For example:

This is why filtering rules must always specify the IP version — a rule that permits type 8 for ping in IPv4 has no meaning in IPv6, where ping uses type 128.