Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
The definition of ICMP message says that it has a type, a code and the first 8 bytes of IP datagram causing error.
Question: Which first eight bytes of IP datagram are included in the ICMP datagram?
My understanding: The portion marked by the red box in the figure below.
Well, the sender might like to know which ones of its packets the ICMP message refers to. For that, the entire IP header plus (at least) the first eight bytes of the IP payload are appended to the ICMP header for error messages.
Check out RFC 792:
This data is used by the host to match the message to the appropriate process. If a higher level protocol uses port numbers, they are assumed to be in the first 64 data bits of the original datagram's data.
Your understanding is wrong.
The 8 bytes are bytes of IP payload and are in addition to the complete IP header of the packet that caused the error. Typically these 8 bytes will be a portion of the header for the transport protocol. They can be used to match up the ICMP error to the connection, or even potentially the individual packet that caused it.
Furthermore while RFC 792 says that 8 bytes of payload should be included, RFC 1812 states that ICMP errors SHOULD include as much of the original packet as possible (within the 576 byte limitation on the size of the ICMP packet). The motivation for this is to support sane handling of ICMP errors in tunneling scenarios.
I am not sure what definition you are referring to (source?), but it probably meant a 8 bit.
An ICMP packet is 8 bytes total[1], the first 16 bits are type and code bytes(eight bits in a byte); the type byte is given a number from 0 to 255[2], a different number representing a different type of sub-code.
As Zac67 stated the sender usually likes to know where the ICMP packet comes from, so it encapsulates it in an IP header, that IP header contains a field called 'protocol' when an ICMP packet is carried in the payload the protocol field is set[3] to 1 (0x01 in hex or 00000001 in binary), the protocol field is also bits (1 byte) long.
Below is some useful resources and sources. Hope this helps.
https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol
http://slideplayer.com/slide/3602717/
http://www.pearsonitcertification.com/articles/article.aspx?p=1804873
[1] - http://www.keyboardbanger.com/wp-content/uploads/2015/07/ICMP-header.png
[2] - https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Control_messages
[3] - https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
