PING/ICMP works at which layer?

[flying.gagan]

I have permitted TCP traffic only in extended ACL in-between two hosts, can't ping them. why?

[Deepak Kumar]

Hi,

The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, like routers, switches, to send error messages and operational information indicating, for example, that a requested service is not available or that a host or router could not be reached.

ICMP differs from transport protocols such as TCP and UDP in that it is not typically used to exchange data between systems, nor is it regularly employed by end-user network applications (with the exception of some diagnostic tools like ping and traceroute).

Regards,

Deepak Kumar

[flying.gagan]

thats more like a definition and the difference between ICMP and TCP which I know. Inbetween I found that ICMP needs help of IP in order to process a request, so when i created an extended ACL and allowed IP traffic inbetween two hosts, i was able to ping, but cannot when I allow TCP so I am trying to find out which layer does ICMP works so that I can relate which one needs help of each other or not. so the question remains still unanswered.

[Karsten Iwen · Accepted solution]

For questions like these, it's best to look how the headers are "stacked". Wikipedia has pages for every protocol. Here is ICMP: https://en.wikipedia.org/wiki/Ping_(networking_utility)

It's the same layer as TCP and UDP. When you allow IP, all protocols based on IP are allowed which are TCP, UDP, ICMP and many others. When allowing TCP, only services based on TCP are allowed. This are for example HTTP, POP3, IMAP4, FTP ...

[ms-cdinoc]

its a layer 3 protocol operates in network layer and not transport layer

[Joseph W. Doherty]

"I have permitted TCP traffic only in extended ACL in-between two hosts, can't ping them. why?"

Simply because ping doesn't use TCP.

In an extended ACL, if you're blocking all but TCP, you'll need to minimally add an ACE, or ACEs, to allow the ping's echo request and/or echo reply.

e.g.
permit icmp any any echo
permit icmp any any echo-reply

As to what layer (7) ping uses on the network, it's its own (L3) IP protocol (i.e. ICMP).  Since its one of the many IP protocols, this is why ping worked when you permitted all of IP.