ICMP Message Format

The ICMP message is encapsulated, as was explained earlier, within the data
field of an IP datagram. To distinguish these messages from an ordinary IP
datagram, the protocol field of the IP datagram contains the value 1, indicating
that the data field in turn contains an ICMP message. This encapsulation
is shown in Figure 3.4.
The ICMP header in turn contains three fields:
• Type, identifying the type of message;
• Code, providing information about the type of message;
• Checksum, containing the checksum of the whole ICMP message.
The algorithm used is the same as for the IP protocol.
As for the data field, its content depends on the type of message. However,
it usually contains two pieces of information: the header of the IP datagram
that caused the error, and the first 64 bits of the data field of the same
datagram. As the IP header is included, the source can determine which datagram provoked the error. In the first 64 bits of the datagram, the header
of the messages of a higher level protocol, usually TCP, can be found. This
can be used to determine which protocol and which application is responsible
for the datagram in question.