ICMPUSH(8)

📦 version 2.2, in debian bookworm, ubuntu jammy, ubuntu noble

ICMPUSH(8) 💖

okay bestie, gather round, because this is icmpush — straight out of the System Manager's Manual, section 8, the big-girl section where all the system admin tools live. it builds ICMP packets. yes, those ICMP packets. the ones your ping uses. we're going ✨custom✨ today. 🎀

NAME 🦋

icmpush — ICMP packet builder. that's it, that's the whole job, and she does it flawlessly. 💅

SYNOPSIS 🌸

icmpush type [options] host

like. give her a type, some options if you're feeling spicy, and a host. boom. packet. ✨

DESCRIPTION 💜

so icmpush is a tool that builds ICMP packets fully customized from the command line. fully. customized. no defaults you didn't ask for, no vibes you didn't choose. you're the main character here and you're writing the packet by hand. 👑

she supports these ICMP error types:

  • Redirect
  • Source Quench
  • Time Exceeded
  • Destination Unreach
  • Parameter Problem

and these ICMP information types:

  • Address Mask Request
  • Timestamp
  • Information Request
  • Echo Request
  • Router Solicitation
  • Router Advertisement

ngl, it is not our job here to give you a full dissertation on how the ICMP protocol works. but fr fr — the more you actually know about it, the more you can fully understand how to manage it, use it, and unlock all the possibilities this tool is hiding. 🧚

okay and yes, the number of arguments can look like a lot. lowkey excessive. but the author himself reminds you: some of this data is imperative — it has to come through the command line so the ICMP packet can be adjusted fully to match the protocol format. it's not extra, it's the format. periodt. 💅

and because we love you, there's a long list of examples down in the EXAMPLES section showing this program in actual real use. 🌈

✨ OPTIONS ✨ 🎀

the basics, the starter pack 🫶

  • -h, --help — help. she's telling you how she works. 💖
  • -V, --version — program version. which girl are we running. 🏷️
  • -v, --verbose — informative mode. she talks more.
  • -vv, --more_verbose — even more informative. genuinely useful when you're debugging, no cap. 🔍

the ICMP type — pick your fighter 🌸

the ICMP type type can be any of these bad boys:

  • -du, --dest_unreach — Destination Unreach. the IP packet couldn't be given. this ICMP type is an error. 😭
  • -sq, --src_quench — Source Quench. the IP packet is not given due to a congestion on the net. this ICMP type is an error.
  • -red, --redirect — Redirect. a request to forward IP packets through another router. this ICMP type is an error.
  • -echo, --echo_request — Echo Request. a request sent to a host to receive an echo reply. this ICMP type is information. ✨
  • -rta, --router_advert address[/preference] — Router Advertisement. the router transmits one or more routers with address address and preference preference. if the preference is omitted, the default preference 0 is given. this ICMP type is information.
  • -rts, --router_solicit — Router Solicitation. the host's requirement for a message of one or more routers. like the previous one, it's part of the Router Discovery message exchange, and this ICMP type is information.
  • -tx, --time_exc — Time Exceeded. Time Exceeded for an IP packet. this ICMP type is an error.
  • -param, --param_problem — Parameter Problem. an erroneous value on a variable of the IP header. this ICMP type is an error.
  • -tstamp, --timestamp — Timestamp. a host request to receive the time of another host. this ICMP type is information.
  • -info, --info_req — Information Request. a host request to receive an Info Reply from another host. this ICMP type is information.
  • -mask, --mask_req — Address Mask Request. used to find out a host network mask. this ICMP type is information.

and the options — the rest of the girlies 💅

  • -sp, --spoof address — the IP address to be used as the source of the ICMP packet. yes bestie, you can be someone else. 🙈
  • -to, --timeout secs — timeout in seconds for reading the answers. only valid on ICMPs of information type, with the exception of the Router Advertisement type (-rta). default is 5 seconds. if 0 is given, answers can not be read. 🕐
  • -n, --no_resolve — don't use name resolution. we're going raw IP, no DNS in the group chat. 🚫
  • -lt, --lifetime secs — lifetime in seconds of the router announcement. only valid with the Router Advertisement (-rta) type. default is 1800 seconds (that's 30', a whole half hour of router announcement realness). ⏳
  • -gw, --gateway address — route gateway address on an ICMP Redirect (-red). by default it'll be the spoof address (-sp) if one was specified, or the outgoing IP address if it wasn't. 🚪
  • -dest, --route_dest address — route destination address on an ICMP Redirect (-red). > this is a required option when sending an ICMP Redirect. don't skip her, she's mandatory. ⚠️
  • -orig, --orig_host address — the original host within the IP header sent in the 64 bits data field of an ICMP error. by default it'll be the same as the IP of the host that sends the ICMP packet.
  • -psrc, --port_src port — source port (tcp or udp) within the IP header sent in the 64 bits data field of an ICMP error. default is 0.
  • -pdst, --port_dest port — destination port (tcp or udp) within the IP header sent in the 64 bits data field of an ICMP error. default is 0.
  • -prot, --protocol icmp|tcp|udp — the protocol to be used within the IP header sent in the 64 bits data field of an ICMP error. must be one of the three listed above. default is Tcp.
  • -id, --echo_id identificator — echo identificator within the IP header sent in the 64 bits data field of an ICMP error, when the IP header protocol of the 64 bits data field (-prot) is icmp. default is 0.
  • -seq, --echo_seq sequence — echo sequence number within the IP header sent in the 64 bits data field of an ICMP error, when the IP header protocol of the 64 bits data field (-prot) is icmp. default is 0.
  • -pat, --pattern pattern — the data pattern to send on an Echo Request (-echo). 🎨
  • -gbg, --garbage bytes|max — the number of garbage bytes that will be sent on any ICMP packet. with max, the maximum possible will be sent. 🗑️✨
  • -ptr, --pointer byte — pointer to the erroneous byte byte on an ICMP packet showing a parameter problem. valid only on the Parameter Problem type (-param). 👉
  • -c, --code code|num|max — the ICMP code to send.
    • a code code is valid for the Destination Unreach (-du), Redirect (-red) and Time Exceeded (-tx) types.
    • a numerical code can be specified for the ICMP types that don't have one (Echo Request, Information Request, Address Mask Request, Router Solicitation, Router Advertisement, Source Quench, Parameter Problem and Timestamp).
    • using max, an ICMP code bigger than the admitted ones will be sent. 😈
    • the next ICMP CODES section enumerates the valid code types. ⬇️

🌈 ICMP CODES 🌈 💖

the valid codes used with the Destination Unreach, Redirect y Time Exceeded types are:

- used with the Destination Unreach type (-du): 💀

  • net-unreach (Net Unreachable) — the destination net is unreacheable.
  • host-unreach (Host Unreachable) — the destination host is unreacheable.
  • prot-unreach (Protocol Unreachable) — the desired protocol is unreacheable to the destination host.
  • port-unreach (Port Unreachable) — the desired port is unreacheable to the destination host.
  • frag-needed (Fragmentation Needed and Don't Fragment was Set) — shows that the IP packet had to be fragmented because of its size, but the sender did not allow it because of the DF (DON'T FRAGMENT) flag.
  • sroute-fail (Source Route Failed) — couldn't follow the route indicated on the IP packet.
  • net-unknown (Destination Network Unknown) — the destination network is unknown.
  • host-unknown (Destination Host Unknown) — destination host unknown, but the network is known.
  • host-isolated (Source Host Isolated) — can't reach the destination host.
  • net-ano (Communication with Destination Network is Administratively Prohibited) — access to the network is denied through a firewall or similar on the receiver side.
  • host-ano (Communication with Destination Host is Administratively Prohibited) — access to the host is denied through a firewall or similar on the receiver side.
  • net-unr-tos (Destination Network Unreachable for Type of Service) — indicates on the destination network that the Type Of Service (TOS) applied for is not allowed.
  • host-unr-tos (Destination Host Unreachable for Type of Service) — shows that the destination host is unreachable with the applied TOS.
  • com-admin-prohib (Communication Administratively Prohibited) — a router can't forward a packet because of an administrative filter.
  • host-precedence-viol (Host Precedence Violation) — the IP packet precedence is not allowed.
  • precedence-cutoff (Precedence cutoff in effect) — a smaller IP packet precedence has tried to be sent over the minimum imposed by the network's manager.

- used with the Redirect type (-red): 🚦

  • net (Redirect Datagram for the Network) — shows that the destination is a network.
  • host (Redirect Datagram for the Host) — shows that the destination is a host.
  • serv-net (Redirect Datagram for the Type Of Service and Network) — the destination is a type of service and network.
  • serv-host (Redirect Datagram for the Type Of Service and Host) — the destination is a type of service and host.

and 💫

- used with the Time Exceeded type (-tx): ⏰

  • ttl (Time to Live exceeded in Transit) — time is over on an IP's header packet.
  • frag (Fragment Reassembly Time Exceeded) — could not put the IP's packet fragment together again.

💀 RETURN CODES 💀 🫶

icmpush can be easily used within shell scripts — she plays nice with others, we love a collaborative queen. the program returns the following data to the shell:

  • 0 — Finished program OK. 🎉
  • 1 — Incorrect argument number.
  • 2 — Unkown ICMP protocol.
  • 3 — Cannot create RAW socket type.
  • 4 — Erroneous ICMP packet.
  • 5 — Erroneous gateway.
  • 6 — Erroneous destination route.
  • 7 — Erroneous ICMP packet code.
  • 8 — Erroneous source host.
  • 9 — Error sending packet.
  • 10 — Protocol still not implemented.
  • 11 — Erroneous IP address or spoof host incorrect.
  • 12 — Could not save memory for the data_hdr union.
  • 13 — Erroneous IP address or packet destination host.
  • 14 — Unkown protocol.
  • 16 — Error reading RAW socket.
  • 17 — Error initializing signal handler SIGALARM.
  • 18 — Echo Request packet data too big.
  • 19 — Source port incorrect.
  • 20 — Destination port incorrect.
  • 21 — Incorrect timeout value.
  • 22 — Incorrect Echo ID.
  • 23 — Incorrect sequence number.
  • 24 — Erroneous Echo data.
  • 25 — IP_HDRINCL error.
  • 26 — Erroneous router address in Router Advertisement.
  • 27 — Incorrect garbage bytes number.
  • 28 — Incorrect ICMP pointer Parameter Problem.
bestie, notice 15 is just… not here. she's not on the list. we don't ask about 15. 💀

💖 EXAMPLES 💖

okay bestie this is the part where it all comes together, fr fr. these are real receipts. copy them, tweak them, live your truth. 🫶

  1. so picture this: somebody already sent a packet with TCP source port 100 and destination port 90, and now we wanna clap back with an ICMP Redirect to asshole.es so it rewrites its routing table. the tea: 10.12.12.12 becomes the gateway to the host death.es, and we mask the packet source so it looks like it came from the host infect.comx. sneaky lil main character move ✨
icmpush -red -sp infect.comx -gw 10.12.12.12 -dest death.es -c host
-prot tcp -psrc 100 -pdst 90 asshole.es
  1. same energy, different victim: an ICMP Echo Request went out with Echo Request id 100 and sequence number 90, and we're sending an ICMP Redirect to hemorroids.es to mess with its routing table. the data: the host pizza.death is the gateway to the host death.es, and we're masking the packet source so it looks like it came from infect.comx. no cap 💅
icmpush -red -sp infect.comx -gw pizza.death -dest death.es -c host
-prot icmp -id 100 -seq 90 hemorroids.es
  1. we wanna send an ICMP Destination Unreach to 10.2.3.4 basically saying "bestie, your TCP port 2100?? our TCP port 20 could never connect to that, it's unreachable." and we're masking ourselves as the host 10.1.1.1. periodt.
icmpush -du -sp 10.1.1.1 -c port-unreach -prot tcp -psrc 2100 -pdst 20
10.2.3.4
  1. another Destination Unreach, this time sliding into 10.2.3.4's DMs to say that the host inferno.hell and its TCP port 69 could not connect to his TCP port 666 — unreachable, sorry babe 😭. and we're masking ourselves as the gateway router.comx.
icmpush -du -sp router.comx -c host-unreach -prot tcp -psrc 666 -pdst 69
-orig inferno.hell 10.2.3.4
  1. now we're sending an ICMP Source Quench to ldg02.hell, replying to a packet that was headed to the host ldg00 over UDP, source port 100 and destination port 200. we mask ourselves as the gateway 10.10.10.1. iconic 🌸
icmpush -sq -sp 10.10.10.1 -prot udp -psrc 100 -pdst 200 -orig ldg00
ldg02.hell
  1. an ICMP Time Exceeded to ldg02.hell, again in response to a packet destined for the host ldg00, UDP protocol, source port 100, destination port 200. this time we mask as the gateway ldg04.hell.
icmpush -tx -sp ldg04.hell -c frag -prot udp -psrc 100 -pdst 200 -orig
ldg00 ldg02.hell
  1. sending an ICMP Address Mask Request and then just... waiting 10 whole seconds to see who replies (the suspense, the drama 💀). we mask the packet with the source address 10.2.3.4 and yeet it to 10.0.1.255.
icmpush -mask -sp 10.2.3.4 -to 10 10.0.1.255
  1. an ICMP Timestamp to sepultura.hell, masking the packet like it was sent from the host 10.2.3.1. we're using the default timeout here, which is 5 seconds — no notes, it's just the vibe.
icmpush -tstamp --spoof 10.2.3.1 sepultura.hell
  1. an ICMP Information Request to voucher.hell. source address is our own IP, and the timeout is 20 seconds because we're patient and emotionally available 💖
icmpush -info -to 20 voucher.hell
  1. an ICMP Router Solicitation to lazy.hell. source address = our own IP, timeout = 20 seconds.
icmpush -rts --timeout 20 lazy.hell
  1. an ICMP Echo Request to lazy.hell carrying the data pattern MyNameIsGump (yes really 🍓). source address is our own IP, and we wait 2 seconds to read the data.
icmpush -echo -data MyNameIsGump -to 2 lazy.hell
  1. an ICMP Echo Request to 10.12.0.255 with a data pattern, and ngl we do not want to read the answers. not today. -to 0 and we're gone 🦋
icmpush -echo -sp 192.168.0.255 -data 'D E A T H' -to 0 192.168.0.255
  1. chaos mode 🔥 an ICMP Destination Unreach to destination.death, sent with an ICMP code that is bigger than the legal ones, plus 60K of garbage data bolted on. this is unhinged and that's the point.
icmpush -du -c max -gbg 60000 destination.death
  1. an ICMP Router Advertisement to death.es, announcing that the routers to use are: router1.xtc with preference 20, router2.xtc with preference 50, and router3.xtc with the default preference (0). and we mask ourselves as fatherouter.xtc 👑
icmpush -rta router1.xtc/20 -rta router2.xtc/50 -rta router3.xtc -sp
fatherouter.xtc death.es
  1. an ICMP Parameter Problem to misery.es saying that the packet sent from the host hick.org, udp protocol, source port 13 and destination port 53, has an error on the IP header byte 13. we also add all the garbage bytes we possibly can, because why not 💅
icmpush -sp hick.org -param -ptr 13 -prot udp -psrc 13 -pdest 53 -gbg
max misery.es
  1. an ICMP Timestamp to www.hicks.org, but with code 38 instead of the usual code (0). because sometimes you just wanna be different ✨
icmpush -tstamp -c 38 www.hicks.org

📚 SEE ALSO 📚

the required reading bestie, the syllabus, the lore:

  • Postel, John, "Internet Control Message Protocol - DARPA Internet Program Protocol Specification", RFC 792, USC/Information Sciences Institute, September 1981.
  • Mogul, Jeffrey and John Postel, "Internet Standard Subnetting Procedure", RFC 950, Stanford, USC/Information Sciences Institute, August 1985.
  • Braden, Robert, "Requeriments for Internet Hosts - Communication Layers", RFC 1122, USC/Information Sciences Institute, October 1989.
  • Deering, Stephen, "ICMP Router Discovery Messages", RFC 1256, Xerox PARC, September 1991.
  • Baker, Fred, "Requeriments for IP Version 4 Routers", RFC 1812, Cisco Systems, June 1995.
  • The Linux source code, everything referent to network code and to ICMP protocol.

👑 AUTHOR 👑

this absolute legend wrote it:

  • Slayer <tcpbgp@softhome.net>

and that's the whole page bestie, we ate and left no crumbs 🎀 this was icmpush v2.2, dated February 22, 1999, and yes it's an ICMPUSH(8) page, so it's giving old-school Unix royalty. go forth and packet, my love 💜🌸✨

📦 where this page comes from