ICMP used UDP or TCP and IP . test question.

yrwins

on a windows out out--> icmp , in <-- ICMP
on a router or Linux out---> UDP, in <--ICMP

so for cisco test is UDP or ICMP

clarson

icmp is an internet layer protocol. It isn't udp or tcp.

OctalDump

I'm not sure I understand your question, but ICMP runs within IP packets, so can be considered to run 'on top of' layer 3. But unlike TCP and UDP it isn't a transport protocol, just a control protocol, so could be considered to run 'at' layer 3.

ICMP definitely does not run inside of or on top of UDP or TCP (unless you are talking about tunnels, but that's a whole different fish kettle). However, IP traffic can cause ICMP traffic, for example in the cast where the TTL on a packet reaches 0 it causes an ICMP type 11 message - time exceeded. Since this is due to the IP packet header TTL, it can be caused by IP packets containing UDP or TCP (or conceivably other) segments/datagrams.

What this means is that for the specific case of traceroute, it can actually use packets containing UDP, TCP or ICMP to transmit with the decrementing TTL. There are various use cases, but the important thing is that the ICMP time exceeded message will be generated as long as it is unicast IP packet: it doesn't care about the content of the packet. This is per the RFC, and as usual, people can (and do) break the rules.

yrwins

wow... thank you.. I'm really lost... I'm looking at wireshark. and it all over the place. ... thank you... thank.. you...