1.\" Copyright (c) 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd December 11, 2024 29.Dt ICMP 4 30.Os 31.Sh NAME 32.Nm icmp 33.Nd Internet Control Message Protocol 34.Sh SYNOPSIS 35.In sys/types.h 36.In sys/socket.h 37.In netinet/in.h 38.Ft int 39.Fn socket AF_INET SOCK_RAW proto 40.Sh DESCRIPTION 41.Tn ICMP 42is the error and control message protocol used 43by 44.Tn IP 45and the Internet protocol family. 46It may be accessed 47through a 48.Dq raw socket 49for network monitoring 50and diagnostic functions. 51The 52.Fa proto 53parameter to the socket call to create an 54.Tn ICMP 55socket 56is obtained from 57.Xr getprotobyname 3 . 58.Tn ICMP 59sockets are connectionless, 60and are normally used with the 61.Xr sendto 2 62and 63.Xr recvfrom 2 64calls, though the 65.Xr connect 2 66call may also be used to fix the destination for future 67packets (in which case the 68.Xr read 2 69or 70.Xr recv 2 71and 72.Xr write 2 73or 74.Xr send 2 75system calls may be used). 76.Pp 77Outgoing packets automatically have an 78.Tn IP 79header prepended to 80them (based on the destination address). 81Incoming packets are received with the 82.Tn IP 83header and options intact. 84.Ss Types 85ICMP messages are classified according to the type and code fields 86present in the ICMP header. 87The abbreviations for the types and codes may be used in rules in 88.Xr pf.conf 5 . 89The following types are defined: 90.Bl -column x xxxxxxxxxxxx -offset indent 91.It Sy Num Ta Sy Abbrev. Ta Sy Description 92.It 0 Ta echorep Ta "Echo reply" 93.It 3 Ta unreach Ta "Destination unreachable" 94.It 4 Ta squench Ta "Packet loss, slow down" 95.It 5 Ta redir Ta "Shorter route exists" 96.It 6 Ta althost Ta "Alternate host address" 97.It 8 Ta echoreq Ta "Echo request" 98.It 9 Ta routeradv Ta "Router advertisement" 99.It 10 Ta routersol Ta "Router solicitation" 100.It 11 Ta timex Ta "Time exceeded" 101.It 12 Ta paramprob Ta "Invalid IP header" 102.It 13 Ta timereq Ta "Timestamp request" 103.It 14 Ta timerep Ta "Timestamp reply" 104.It 15 Ta inforeq Ta "Information request" 105.It 16 Ta inforep Ta "Information reply" 106.It 17 Ta maskreq Ta "Address mask request" 107.It 18 Ta maskrep Ta "Address mask reply" 108.It 30 Ta trace Ta Traceroute 109.It 31 Ta dataconv Ta "Data conversion problem" 110.It 32 Ta mobredir Ta "Mobile host redirection" 111.It 33 Ta ipv6-where Ta "IPv6 where-are-you" 112.It 34 Ta ipv6-here Ta "IPv6 i-am-here" 113.It 35 Ta mobregreq Ta "Mobile registration request" 114.It 36 Ta mobregrep Ta "Mobile registration reply" 115.It 39 Ta skip Ta SKIP 116.It 40 Ta photuris Ta Photuris 117.El 118.Pp 119The following codes are defined: 120.Bl -column x xxxxxxxxxxxx xxxxxxxx -offset indent 121.It Sy Num Ta Sy Abbrev. Ta Sy Type Ta Sy Description 122.It 0 Ta net-unr Ta unreach Ta "Network unreachable" 123.It 1 Ta host-unr Ta unreach Ta "Host unreachable" 124.It 2 Ta proto-unr Ta unreach Ta "Protocol unreachable" 125.It 3 Ta port-unr Ta unreach Ta "Port unreachable" 126.It 4 Ta needfrag Ta unreach Ta "Fragmentation needed but DF bit set" 127.It 5 Ta srcfail Ta unreach Ta "Source routing failed" 128.It 6 Ta net-unk Ta unreach Ta "Network unknown" 129.It 7 Ta host-unk Ta unreach Ta "Host unknown" 130.It 8 Ta isolate Ta unreach Ta "Host isolated" 131.It 9 Ta net-prohib Ta unreach Ta "Network administratively prohibited" 132.It 10 Ta host-prohib Ta unreach Ta "Host administratively prohibited" 133.It 11 Ta net-tos Ta unreach Ta "Invalid TOS for network" 134.It 12 Ta host-tos Ta unreach Ta "Invalid TOS for host" 135.It 13 Ta filter-prohib Ta unreach Ta "Prohibited access" 136.It 14 Ta host-preced Ta unreach Ta "Precedence violation" 137.It 15 Ta cutoff-preced Ta unreach Ta "Precedence cutoff" 138.It 0 Ta redir-net Ta redir Ta "Shorter route for network" 139.It 1 Ta redir-host Ta redir Ta "Shorter route for host" 140.It 2 Ta redir-tos-net Ta redir Ta "Shorter route for TOS and network" 141.It 3 Ta redir-tos-host Ta redir Ta "Shorter route for TOS and host" 142.It 0 Ta normal-adv Ta routeradv Ta "Normal advertisement" 143.It 16 Ta common-adv Ta routeradv Ta "Selective advertisement" 144.It 0 Ta transit Ta timex Ta "Time exceeded in transit" 145.It 1 Ta reassemb Ta timex Ta "Time exceeded in reassembly" 146.It 0 Ta badhead Ta paramprob Ta "Invalid option pointer" 147.It 1 Ta optmiss Ta paramprob Ta "Missing option" 148.It 2 Ta badlen Ta paramprob Ta "Invalid length" 149.It 1 Ta unknown-ind Ta photuris Ta "Unknown security index" 150.It 2 Ta auth-fail Ta photuris Ta "Authentication failed" 151.It 3 Ta decrypt-fail Ta photuris Ta "Decryption failed" 152.El 153.Ss MIB (sysctl) Variables 154The 155.Tn ICMP 156protocol implements a number of variables in the 157.Va net.inet.icmp 158branch of the 159.Xr sysctl 3 160MIB, which can also be read or modified with 161.Xr sysctl 8 . 162.Bl -tag -width ".Va icmplim_output" 163.It Va bmcastecho 164.Pq Vt boolean 165Enable/disable ICMP replies received via broadcast or multicast. 166Defaults to false. 167.It Va drop_redirect 168.Pq Vt boolean 169Enable/disable dropping of ICMP Redirect packets. 170Defaults to false. 171.It Va icmplim 172.Pq Vt unsigned integer 173Mean rate limit for replies in packets/second. 174The actual limit is 175.Va icmplim 176plus a random jitter limited by 177.Va icmplim_jitter . 178If set to zero, no limiting will occur. 179Defaults to 200. 180.It Va icmplim_jitter 181.Pq Vt unsigned integer 182A random jitter between the negative of 183.Va icmplim_jitter 184and 185.Va icmplim_jitter 186is applied to 187.Va icmplim 188for limiting the sending rate of replies. 189.Va icmplim_jitter 190must be smaller than 191.Va icmplim , 192if 193.Va icmplim 194is not zero. 195If set to zero, no jitter will be applied. 196Defaults to 16. 197.It Va icmplim_output 198.Pq Vt boolean 199Enable/disable logging of ICMP replies bandwidth limiting. 200Defaults to true. 201.It Va log_redirect 202.Pq Vt boolean 203Enable/disable logging of ICMP Redirect packets. 204Defaults to false. 205.It Va maskfake 206.Pq Vt "unsigned integer" 207When 208.Va maskrepl 209is set and this value is non-zero, 210it will be used instead of the real address mask when 211the system replies to an ICMP Address Mask Request packet. 212Defaults to 0. 213.It Va maskrepl 214.Pq Vt boolean 215Enable/disable replies to ICMP Address Mask Request packets. 216Defaults to false. 217.It Va quotelen 218.Pq Vt integer 219Number of bytes from original packet to quote in ICMP reply. 220This number is internally enforced to be at least 8 bytes (per RFC792) 221and at most the maximal space left in the ICMP reply mbuf. 222.It Va redirtimeout 223.Pq Vt integer 224Delay in seconds before expiring route created by ICMP redirect. 225.It Va reply_from_interface 226.Pq Vt boolean 227Use the IP address of the interface the packet came in through for 228responses to packets which are not directly addressed to us. 229If enabled, this rule is processed before all others. 230By default, continue with normal source selection. 231Enabling this option is particularly useful on routers because it 232makes external traceroutes show the actual path a packet has taken 233instead of the possibly different return path. 234.It Va reply_src 235.Pq Vt str 236An interface name used for the ICMP reply source in response to packets 237which are not directly addressed to us. 238By default continue with normal source selection. 239.It Va tstamprepl 240.Pq Vt boolean 241Enable/disable replies to ICMP Timestamp packets. 242Defaults to true. 243.El 244.Sh ERRORS 245A socket operation may fail with one of the following errors returned: 246.Bl -tag -width Er 247.It Bq Er EISCONN 248when trying to establish a connection on a socket which 249already has one, or when trying to send a datagram with the destination 250address specified and the socket is already connected; 251.It Bq Er ENOTCONN 252when trying to send a datagram, but 253no destination address is specified, and the socket has not been 254connected; 255.It Bq Er ENOBUFS 256when the system runs out of memory for 257an internal data structure; 258.It Bq Er EADDRNOTAVAIL 259when an attempt is made to create a 260socket with a network address for which no network interface 261exists. 262.El 263.Sh SEE ALSO 264.Xr recv 2 , 265.Xr send 2 , 266.Xr sysctl 3 , 267.Xr inet 4 , 268.Xr intro 4 , 269.Xr ip 4 , 270.Xr pf.conf 5 , 271.Xr sysctl 8 272.Sh HISTORY 273The 274.Nm 275protocol implementation appeared in 276.Bx 4.2 . 277