07-01-2014 08:38 PM - edited 03-11-2019 09:24 PM
hi all,
was doing some troubleshooting for allowing ICMP on one of our ASA (8.2) and got stuck with ICMP type and code.
i've searched that ICMP type 11 is used by windows (link below). but would like to know what are the other ICMP types especially used by cisco devices.
http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html
ASA# packet-tracer input inside icmp ?
A.B.C.D Enter the Source address if ipv4
X:X:X:X::X Enter the Source address if ipv6
ASA# packet-tracer input inside icmp 1.1.1.1 ?
<0-255> Enter the icmp type
ASA# packet-tracer input inside icmp 1.1.1.1 1 ?
<0-255> Enter the icmp code
Solved! Go to Solution.
07-01-2014 09:53 PM
As far as I understand according to rfc by ietf, type 11 is 'time exceeded.' And there are 2 codes with that type. Here is a link for the RFC792:
http://tools.ietf.org/html/rfc792
ICMP TYPE NUMBERS The Internet Control Message Protocol (ICMP) has many messages that are identified by a "type" field. Type Name Reference ---- ------------------------- --------- 0 Echo Reply [RFC792] 1 Unassigned [JBP] 2 Unassigned [JBP] 3 Destination Unreachable [RFC792] 4 Source Quench [RFC792] 5 Redirect [RFC792] 6 Alternate Host Address [JBP] 7 Unassigned [JBP] 8 Echo [RFC792] 9 Router Advertisement [RFC1256] 10 Router Selection [RFC1256] 11 Time Exceeded [RFC792] 12 Parameter Problem [RFC792] 13 Timestamp [RFC792] 14 Timestamp Reply [RFC792] 15 Information Request [RFC792] 16 Information Reply [RFC792] 17 Address Mask Request [RFC950] 18 Address Mask Reply [RFC950] 19 Reserved (for Security) [Solo] 20-29 Reserved (for Robustness Experiment) [ZSu] 30 Traceroute [RFC1393] 31 Datagram Conversion Error [RFC1475] 32 Mobile Host Redirect [David Johnson] 33 IPv6 Where-Are-You [Bill Simpson] 34 IPv6 I-Am-Here [Bill Simpson] 35 Mobile Registration Request [Bill Simpson] 36 Mobile Registration Reply [Bill Simpson] 37 Domain Name Request [Simpson] 38 Domain Name Reply [Simpson] 39 SKIP [Markson] 40 Photuris [Simpson] 41-255 Reserved [JBP]
Many of these ICMP types have a "code" field. Here we list the types again with their assigned code fields. Type Name Reference ---- ------------------------- --------- 0 Echo Reply [RFC792] Codes 0 No Code 1 Unassigned [JBP] 2 Unassigned [JBP] 3 Destination Unreachable [RFC792] Codes 0 Net Unreachable 1 Host Unreachable 2 Protocol Unreachable 3 Port Unreachable 4 Fragmentation Needed and Don't Fragment was Set 5 Source Route Failed 6 Destination Network Unknown 7 Destination Host Unknown 8 Source Host Isolated 9 Communication with Destination Network is Administratively Prohibited 10 Communication with Destination Host is Administratively Prohibited 11 Destination Network Unreachable for Type of Service 12 Destination Host Unreachable for Type of Service 13 Communication Administratively Prohibited [RFC1812] 14 Host Precedence Violation [RFC1812] 15 Precedence cutoff in effect [RFC1812] 4 Source Quench [RFC792] Codes 0 No Code 5 Redirect [RFC792] Codes 0 Redirect Datagram for the Network (or subnet) 1 Redirect Datagram for the Host 2 Redirect Datagram for the Type of Service and Network 3 Redirect Datagram for the Type of Service and Host 6 Alternate Host Address [JBP] Codes 0 Alternate Address for Host 7 Unassigned [JBP] 8 Echo [RFC792] Codes 0 No Code 9 Router Advertisement [RFC1256] Codes 0 No Code 10 Router Selection [RFC1256] Codes 0 No Code 11 Time Exceeded [RFC792] Codes 0 Time to Live exceeded in Transit 1 Fragment Reassembly Time Exceeded 12 Parameter Problem [RFC792] Codes 0 Pointer indicates the error 1 Missing a Required Option [RFC1108] 2 Bad Length 13 Timestamp [RFC792] Codes 0 No Code 14 Timestamp Reply [RFC792] Codes 0 No Code 15 Information Request [RFC792] Codes 0 No Code 16 Information Reply [RFC792] Codes 0 No Code 17 Address Mask Request [RFC950] Codes 0 No Code 18 Address Mask Reply [RFC950] Codes 0 No Code 19 Reserved (for Security) [Solo] 20-29 Reserved (for Robustness Experiment) [ZSu] 30 Traceroute [RFC1393] 31 Datagram Conversion Error [RFC1475] 32 Mobile Host Redirect [David Johnson] 33 IPv6 Where-Are-You [Bill Simpson] 34 IPv6 I-Am-Here [Bill Simpson] 35 Mobile Registration Request [Bill Simpson] 36 Mobile Registration Reply [Bill Simpson] 39 SKIP [Markson] 40 Photuris [Simpson]
Most or some of the ones on that list are probably deprecated by now, as other RFC's have obsoleted them.
Did that give you some direction?
07-02-2014 12:48 AM
Hi John,
If you wanna check ping then select icmp type 8 that is echo.. if it is trace then use 30..... it depends on your requirement...
packet-tracer input inside icmp 192.168.1.10 8 0 172.16.1.2 detailed
in the above code i have mentioned the icmp type as echo i.e. ping outgoing.... and identifier for echo is 0.. we do not have any options.... and then the destination address....
Regards
Karthik
07-01-2014 09:53 PM
As far as I understand according to rfc by ietf, type 11 is 'time exceeded.' And there are 2 codes with that type. Here is a link for the RFC792:
http://tools.ietf.org/html/rfc792
ICMP TYPE NUMBERS The Internet Control Message Protocol (ICMP) has many messages that are identified by a "type" field. Type Name Reference ---- ------------------------- --------- 0 Echo Reply [RFC792] 1 Unassigned [JBP] 2 Unassigned [JBP] 3 Destination Unreachable [RFC792] 4 Source Quench [RFC792] 5 Redirect [RFC792] 6 Alternate Host Address [JBP] 7 Unassigned [JBP] 8 Echo [RFC792] 9 Router Advertisement [RFC1256] 10 Router Selection [RFC1256] 11 Time Exceeded [RFC792] 12 Parameter Problem [RFC792] 13 Timestamp [RFC792] 14 Timestamp Reply [RFC792] 15 Information Request [RFC792] 16 Information Reply [RFC792] 17 Address Mask Request [RFC950] 18 Address Mask Reply [RFC950] 19 Reserved (for Security) [Solo] 20-29 Reserved (for Robustness Experiment) [ZSu] 30 Traceroute [RFC1393] 31 Datagram Conversion Error [RFC1475] 32 Mobile Host Redirect [David Johnson] 33 IPv6 Where-Are-You [Bill Simpson] 34 IPv6 I-Am-Here [Bill Simpson] 35 Mobile Registration Request [Bill Simpson] 36 Mobile Registration Reply [Bill Simpson] 37 Domain Name Request [Simpson] 38 Domain Name Reply [Simpson] 39 SKIP [Markson] 40 Photuris [Simpson] 41-255 Reserved [JBP]
Many of these ICMP types have a "code" field. Here we list the types again with their assigned code fields. Type Name Reference ---- ------------------------- --------- 0 Echo Reply [RFC792] Codes 0 No Code 1 Unassigned [JBP] 2 Unassigned [JBP] 3 Destination Unreachable [RFC792] Codes 0 Net Unreachable 1 Host Unreachable 2 Protocol Unreachable 3 Port Unreachable 4 Fragmentation Needed and Don't Fragment was Set 5 Source Route Failed 6 Destination Network Unknown 7 Destination Host Unknown 8 Source Host Isolated 9 Communication with Destination Network is Administratively Prohibited 10 Communication with Destination Host is Administratively Prohibited 11 Destination Network Unreachable for Type of Service 12 Destination Host Unreachable for Type of Service 13 Communication Administratively Prohibited [RFC1812] 14 Host Precedence Violation [RFC1812] 15 Precedence cutoff in effect [RFC1812] 4 Source Quench [RFC792] Codes 0 No Code 5 Redirect [RFC792] Codes 0 Redirect Datagram for the Network (or subnet) 1 Redirect Datagram for the Host 2 Redirect Datagram for the Type of Service and Network 3 Redirect Datagram for the Type of Service and Host 6 Alternate Host Address [JBP] Codes 0 Alternate Address for Host 7 Unassigned [JBP] 8 Echo [RFC792] Codes 0 No Code 9 Router Advertisement [RFC1256] Codes 0 No Code 10 Router Selection [RFC1256] Codes 0 No Code 11 Time Exceeded [RFC792] Codes 0 Time to Live exceeded in Transit 1 Fragment Reassembly Time Exceeded 12 Parameter Problem [RFC792] Codes 0 Pointer indicates the error 1 Missing a Required Option [RFC1108] 2 Bad Length 13 Timestamp [RFC792] Codes 0 No Code 14 Timestamp Reply [RFC792] Codes 0 No Code 15 Information Request [RFC792] Codes 0 No Code 16 Information Reply [RFC792] Codes 0 No Code 17 Address Mask Request [RFC950] Codes 0 No Code 18 Address Mask Reply [RFC950] Codes 0 No Code 19 Reserved (for Security) [Solo] 20-29 Reserved (for Robustness Experiment) [ZSu] 30 Traceroute [RFC1393] 31 Datagram Conversion Error [RFC1475] 32 Mobile Host Redirect [David Johnson] 33 IPv6 Where-Are-You [Bill Simpson] 34 IPv6 I-Am-Here [Bill Simpson] 35 Mobile Registration Request [Bill Simpson] 36 Mobile Registration Reply [Bill Simpson] 39 SKIP [Markson] 40 Photuris [Simpson]
Most or some of the ones on that list are probably deprecated by now, as other RFC's have obsoleted them.
Did that give you some direction?
07-01-2014 11:23 PM
hi,
thanks for this info!
so when using packet-tracer command on an ASA, what's the best ICMP code/type can i normally use?
07-02-2014 12:48 AM
Hi John,
If you wanna check ping then select icmp type 8 that is echo.. if it is trace then use 30..... it depends on your requirement...
packet-tracer input inside icmp 192.168.1.10 8 0 172.16.1.2 detailed
in the above code i have mentioned the icmp type as echo i.e. ping outgoing.... and identifier for echo is 0.. we do not have any options.... and then the destination address....
Regards
Karthik
07-02-2014 01:03 AM
karthik,
thanks!
it's just what i need.
06-21-2023 09:34 PM
Hi,
As you said you need this for ping,
packet-tracer input inside icmp 192.168.1.10 8 0 172.16.1.2 detailed
What do I need to do if I'm doing a trace route through the firewall. My host is in the trusted zone
I'm looking for the type and code value that I should be using for trace route in packet-tracer.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide