Well, it's time for us to focus a bit on the Internet control message protocol or ICMP.
This is a critical IP management protocol and it is also a frequent source of hacking type activities.
Why is this?
Well, ICMP is a supporting protocol.
And what we mean by this is we absolutely love it and crave it.
As network administrators, as supporters of the network, as information security analysts, as penetration
testers.
We love ICMP, but at the same time, we hate ICMP.
You see, when you're managing a network, ICMP can make your job one heck of a lot easier.
But if you are using ICMP throughout your network and you're permitting it, that means that your network
is technically more susceptible, has a much greater attack surface when it comes to computer criminals
being able to perform reconnaissance and other styles of attacks against you.
So it's a good thing and it's also a bad thing.
So that can be really problematic.
Now, I've been teaching Cisco networking for a real, real long time.
And one of the classic questions that would often come up in Cisco networking certification exams would
be What does ICMP use, TCP or UDP?
It, of course, that is a bit of a trick question because ICMP doesn't use TCP or UDP at all.
This is a support protocol that uses its own unique protocol.
And in fact, remember, in the IP packet header, there's going to be a protocol number.
And we know that six is used for TCP traffic and 17 is used for UDP traffic.
Well, guess what?
ICMP carries its own IP protocol number, and I think it's pretty important.
It's number one.
That's right.
So IP protocol number one is reserved for ICMP traffic.
It does not rely on transmission control protocol or user datagram protocol in order to do its job.
What is it really for?
Well, it was designed for error message and other types of operational data.
And the most famous utility that uses ICMP to test reachability is the packet internet, groper, utility
or ping.
It will send echo messages and it hopes to receive echo replies as a way to determine that a remote
system is alive and healthy.
Let me go ahead and demonstrate the power of ping right now.
Now, you can see I'm on my windows machine and I'm going to run the command prompt as an administrator.
Why we like to operate with the command prompt as an administrator is just in case.
Whatever hacking we're about to do, we have the privileges on the Windows machine to do it.
So I'm going to go ahead and issue a ping.
And the first thing that we are going to ping is our own loopback address.
So we are pinging ourselves here.
And notice by default on the Windows environment, ping is going to send four packets by default this
number of packets that is sent by the packet internet groper.
This is going to be operating system dependent what the default is.
Windows sends four as we can see and I should be specific.
Windows 11 sends four packets.
Notice the packets were sent to the 120 7001 address.
Notice all four were sent.
All four received.
There was none lost.
And notice it was so fast to ping ourselves that the minimum, maximum and average millisecond times
did not even register.
They were sub millisecond times.
I would hope that our own machine would respond that quickly.
Now let me do an IP config because I see that we are at the address of 192168 127 and I see that we
have a default gateway of 1916811.
That default gateway is how we get off our local subnet.
Let's make sure we can ping that default gateway.
So I'm going to ping 19216811.
And sure enough, we can reach our default gateway.
That explains how I'm able to get out to the internet right now.
Notice the average round trip times in milliseconds are very good.
So one millisecond, for millisecond, two millisecond we would expect we would have very fast connectivity
to our local router.
Now let's try something much more fun.
We're going to ping and I'm going to send a number of packets of ten.
So notice the syntax in windows is dash n and then ten for the number of packets that we are going to
send.
These will be ICMP echo packets and they're hoping for ICMP echo replies.
And I'm going to try and ping yahoo.com the web server.
One of them that is going to answer for WW w yahoo.com.
Notice that I'm going to need DNS to work as well.
If we don't have our DNS operational, this is never going to work because notice one of the first things
that our machine needs to do is it needs to use DNS to resolve the name of w w w dot yahoo.com to the
actual IP address of one of the Yahoo.com web servers.
And sure enough, one of the Yahoo.com Web servers is alive at 70 461 4326.
And its actual name in DNS is this name right here.
It's the new RFP shared G1 B Yahoo.com server.
Interesting.
So we can see the alias that is used for the actual name of that server.
We were able to ping it and you can see now that we are out on the internet, we are receiving much
larger times as far as the round trip time of the packet.
Now a lot of times you're going to do a ping and you are going to put in a URL like this and you might
not get a response.
So you might not have success with any of the ping packets.
What does this mean?
Well, it means either you can't resolve the DNS name or it means much more likely that they are blocking
ping responses so they are not allowing ping to be used against that server.
I would imagine if we went to ww w dot gov dot org for example.
Oh, look at this.
Of course that is blocked just as you would expect it to be.
So notice we did resolve that address to an actual location on the Internet.
And of course that device is set up so that it will not respond to any of those tests.
Ping packets.
So when we eventually get all of them timing out and it's going to take some time, we will see that
no packets were successfully responded to.
This is certainly because the gov dawgs server is not responding to pings.
Notice this is great from a security standpoint, but it's not so great for us if we are supporting
the gov dawg server because we just lost the ability to ping it to see if it is alive.
So it's a balancing act.
We play with these management protocols like ICMP, balancing the ease of managing our network against
the ease of securing our network.
I hope you enjoyed this.
Look at the Internet control message protocol.