Wireshark ICMP Analysis: Diagnose Ping and Errors (2026)

ICMP is the unsung hero of network diagnostics, the protocol your tools use to ask "Are you there?" and "What went wrong?" when packets go astray.

Let’s watch ICMP in action. Imagine you’re trying to ping a server at 192.168.1.100 and it’s not responding. You fire up Wireshark on your machine, filter for icmp, and start pinging.

PING 192.168.1.100 (192.168.1.100): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4

In Wireshark, you’d see a stream of ICMP "Echo Request" packets (type 8) going out from your IP to 192.168.1.100. Crucially, you’d not see corresponding "Echo Reply" packets (type 0) coming back. If you did see "Echo Reply" packets, but the ping still failed, you’d be looking at a different problem entirely – perhaps an application-level issue, not a basic network connectivity one.

This absence of replies is the first clue. It tells us that either the "Echo Request" never reached 192.168.1.100, or the "Echo Reply" never made it back to you. The ICMP protocol itself, defined in RFC 792, provides a set of message types that help pinpoint the exact nature of the problem. Beyond "Echo Request" and "Echo Reply," we’ll encounter types like "Destination Unreachable" (type 3) and "Time Exceeded" (type 11).

Let’s drill into "Destination Unreachable." This is ICMP’s way of saying, "I got your packet, but I can’t deliver it to where you’re sending it." It’s often accompanied by a "code" that specifies why it’s unreachable.

• Code 0: Network Unreachable. The router that received the packet doesn’t know how to get to the destination network. This usually means a routing problem on an intermediate router.

  • Diagnosis: On the router that sent the "Destination Unreachable" message (you’d see its IP in the "Source" field of the ICMP packet), check its routing table. For example, on Cisco: show ip route.
  • Fix: Add or correct the static route, or ensure dynamic routing protocols are advertising the correct paths. For instance, ip route 192.168.0.0 255.255.0.0 10.1.1.1 might be needed.
  • Why it works: The router now has a known path to the destination network, allowing it to forward packets instead of discarding them and sending an ICMP error.

• Code 1: Host Unreachable. The router knows how to reach the destination network, but the specific host on that network is unreachable. This could mean the host is down, or there’s a problem on the local segment (like a misconfigured switch port).

  • Diagnosis: Check ARP tables on the nearest router or the sending host. On Linux: arp -n. On Cisco: show arp. Look for the IP address 192.168.1.100 and its corresponding MAC address. If it’s missing or stale, that’s a clue.
  • Fix: Ensure the host is powered on and has a valid IP configuration. If it’s a L2 issue, check switch port status and VLAN assignments.
  • Why it works: A valid ARP entry or a responsive host allows Layer 2 connectivity, which is required for Layer 3 packets to reach their final destination.

• Code 3: Port Unreachable. This is a bit of a misnomer as ICMP "Port Unreachable" is actually a Layer 3 error, not a Layer 4 (TCP/UDP) one. It means the destination host received the packet, but no application is listening on the target port. This is common with UDP.

  • Diagnosis: On the destination host (192.168.1.100), check which processes are listening on the target port. For example, netstat -tulnp | grep 53 (for UDP port 53).
  • Fix: Start the application that should be listening on that port, or change the application’s configuration to use a different port.
  • Why it works: The packet can now be delivered to an active application on the destination host.

• Code 11: Time Exceeded. This ICMP message is generated when a packet’s Time-To-Live (TTL) value reaches zero before it reaches its destination. The TTL is a hop count that prevents packets from endlessly looping in the network.

  • Code 0: TTL equals 0 during transit. A router decremented the TTL to zero.
    • Diagnosis: In Wireshark, you’ll see the "Time Exceeded" packet originating from an intermediate router. The packet payload will contain the original IP packet, including its initial TTL. Compare this to the known default TTLs for your OS (e.g., Windows default is often 128, Linux 64). A low initial TTL could be the culprit.
    • Fix: Increase the TTL on the originating host. For Linux, this is done via sysctl -w net.ipv4.ip_ttl=128. For Windows, it’s a registry change under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DefaultTTL.
    • Why it works: The packet now has more "hops" available, allowing it to traverse the network without expiring prematurely.
  • Code 1: Fragment reassembly time exceeded. This occurs when a fragmented IP packet doesn’t have all its pieces arrive within a certain timeframe for reassembly.
    • Diagnosis: Look for fragmented IP packets in Wireshark (check the "More fragments" flag in the IP header). If you see "Time Exceeded" messages with code 1, it indicates reassembly issues. This is often a symptom of network congestion or packet loss.
    • Fix: Avoid fragmentation by ensuring packets are smaller than the Maximum Transmission Unit (MTU) of the path (e.g., using ping -s 1472 <host> to test without fragmentation). Alternatively, use Path MTU Discovery (PMTUD) to dynamically adjust packet sizes.
    • Why it works: By ensuring packets are not fragmented or that fragments arrive promptly, the destination can successfully reassemble them.

If you’ve meticulously checked all these ICMP error types and your ping still fails, the problem might be a firewall blocking ICMP. Many networks block "Destination Unreachable" messages by default to prevent reconnaissance, which can mask underlying connectivity issues.

The next error you’ll likely encounter after fixing ICMP issues is an application-specific error, like "Connection refused" or a TCP retransmission timeout, indicating that while basic network connectivity is restored, the application layer isn’t quite there yet.