ICMP
is the error and control message protocol used
by
IP
and the Internet protocol family.
It may be accessed
through a
``raw socket''
for network monitoring
and diagnostic functions.
The
Fa proto
parameter to the socket call to create an
ICMP
socket
is obtained from
getprotobyname(3).
ICMP
sockets are connectionless,
and are normally used with the
sendto(2)
and
recvfrom(2)
calls, though the
connect(2)
call may also be used to fix the destination for future
packets (in which case the
read(2)
or
recv(2)
and
write(2)
or
send(2)
system calls may be used).
Outgoing packets automatically have an
IP
header prepended to
them (based on the destination address).
Incoming packets are received with the
IP
header and options intact.
Types
ICMP messages are classified according to the type and code fields
present in the ICMP header.
The abbreviations for the types and codes may be used in rules in
pf.conf5.
The following types are defined:
Num Ta Abbrev. Ta Description
0 Ta echorep Ta Echo reply
3 Ta unreach Ta Destination unreachable
4 Ta squench Ta Packet loss, slow down
5 Ta redir Ta Shorter route exists
6 Ta althost Ta Alternate host address
8 Ta echoreq Ta Echo request
9 Ta routeradv Ta Router advertisement
10 Ta routersol Ta Router solicitation
11 Ta timex Ta Time exceeded
12 Ta paramprob Ta Invalid IP header
13 Ta timereq Ta Timestamp request
14 Ta timerep Ta Timestamp reply
15 Ta inforeq Ta Information request
16 Ta inforep Ta Information reply
17 Ta maskreq Ta Address mask request
18 Ta maskrep Ta Address mask reply
30 Ta trace Ta Traceroute
31 Ta dataconv Ta Data conversion problem
32 Ta mobredir Ta Mobile host redirection
33 Ta ipv6-where Ta IPv6 where-are-you
34 Ta ipv6-here Ta IPv6 i-am-here
35 Ta mobregreq Ta Mobile registration request
36 Ta mobregrep Ta Mobile registration reply
39 Ta skip Ta SKIP
40 Ta photuris Ta Photuris
The following codes are defined:
Num Ta Abbrev. Ta Type Ta Description
0 Ta net-unr Ta unreach Ta Network unreachable
1 Ta host-unr Ta unreach Ta Host unreachable
2 Ta proto-unr Ta unreach Ta Protocol unreachable
3 Ta port-unr Ta unreach Ta Port unreachable
4 Ta needfrag Ta unreach Ta Fragmentation needed but DF bit set
5 Ta srcfail Ta unreach Ta Source routing failed
6 Ta net-unk Ta unreach Ta Network unknown
7 Ta host-unk Ta unreach Ta Host unknown
8 Ta isolate Ta unreach Ta Host isolated
9 Ta net-prohib Ta unreach Ta Network administratively prohibited
10 Ta host-prohib Ta unreach Ta Host administratively prohibited
11 Ta net-tos Ta unreach Ta Invalid TOS for network
12 Ta host-tos Ta unreach Ta Invalid TOS for host
13 Ta filter-prohib Ta unreach Ta Prohibited access
14 Ta host-preced Ta unreach Ta Precedence violation
15 Ta cutoff-preced Ta unreach Ta Precedence cutoff
0 Ta redir-net Ta redir Ta Shorter route for network
1 Ta redir-host Ta redir Ta Shorter route for host
2 Ta redir-tos-net Ta redir Ta Shorter route for TOS and network
3 Ta redir-tos-host Ta redir Ta Shorter route for TOS and host
0 Ta normal-adv Ta routeradv Ta Normal advertisement
16 Ta common-adv Ta routeradv Ta Selective advertisement
0 Ta transit Ta timex Ta Time exceeded in transit
1 Ta reassemb Ta timex Ta Time exceeded in reassembly
0 Ta badhead Ta paramprob Ta Invalid option pointer
1 Ta optmiss Ta paramprob Ta Missing option
2 Ta badlen Ta paramprob Ta Invalid length
1 Ta unknown-ind Ta photuris Ta Unknown security index
2 Ta auth-fail Ta photuris Ta Authentication failed
3 Ta decrypt-fail Ta photuris Ta Decryption failed
MIB Variables
The
ICMP
protocol implements a number of variables in the
net.inet.icmp
branch of the
sysctl(3)
MIB.
maskrepl
(Vt boolean
)
Enable/disable replies to ICMP Address Mask Request packets.
Defaults to false.
maskfake
(Vt unsigned integer
)
When
maskrepl
is set and this value is non-zero,
it will be used instead of the real address mask when
the system replies to an ICMP Address Mask Request packet.
Defaults to 0.
icmplim
(Vt integer
)
Bandwidth limit for ICMP replies in packets/second.
Used when
icmplim_output
is non-zero.
Defaults to 200.
icmplim_output
(Vt boolean
)
Enable/disable bandwidth limiting of ICMP replies.
Defaults to true.
drop_redirect
(Vt boolean
)
Enable/disable dropping of ICMP Redirect packets.
Defaults to false.
log_redirect
(Vt boolean
)
Enable/disable logging of ICMP Redirect packets.
Defaults to false.
bmcastecho
(Vt boolean
)
Enable/disable ICMP replies received via broadcast or multicast.
Defaults to false.
reply_src
(Vt str
)
An interface name used for the ICMP reply source in response to packets
which are not directly addressed to us.
By default continue with normal source selection.
reply_from_interface
(Vt boolean
)
Use the IP address of the interface the packet came through in for
responses to packets which are not directly addressed to us.
If enabled, this rule is processed before all others.
By default, continue with normal source selection.
Enabling this option is particularly useful on routers because it
makes external traceroutes show the actual path a packet has taken
instead of the possibly different return path.
quotelen
(Vt integer
)
Number of bytes from original packet to quote in ICMP reply.
This number is internally enforced to be at least 8 bytes (per RFC792)
and at most the maximal space left in the ICMP reply mbuf.
ERRORS
A socket operation may fail with one of the following errors returned:
Bq Er EISCONN
when trying to establish a connection on a socket which
already has one, or when trying to send a datagram with the destination
address specified and the socket is already connected;
Bq Er ENOTCONN
when trying to send a datagram, but
no destination address is specified, and the socket has not been
connected;
Bq Er ENOBUFS
when the system runs out of memory for
an internal data structure;
Bq Er EADDRNOTAVAIL
when an attempt is made to create a
socket with a network address for which no network interface
exists.
