The definition of ICMP message says that it has a type, a code and the first 8 bytes of IP datagram causing error.

Question: Which first eight bytes of IP datagram are included in the ICMP datagram?

My understanding: The portion marked by the red box in the figure below.

enter image description here

3 Answers 3


Well, the sender might like to know which ones of its packets the ICMP message refers to. For that, the entire IP header plus (at least) the first eight bytes of the IP payload are appended to the ICMP header for error messages.

Check out RFC 792:

This data is used by the host to match the message to the appropriate process. If a higher level protocol uses port numbers, they are assumed to be in the first 64 data bits of the original datagram's data.


Your understanding is wrong.

The 8 bytes are bytes of IP payload and are in addition to the complete IP header of the packet that caused the error. Typically these 8 bytes will be a portion of the header for the transport protocol. They can be used to match up the ICMP error to the connection, or even potentially the individual packet that caused it.

Furthermore while RFC 792 says that 8 bytes of payload should be included, RFC 1812 states that ICMP errors SHOULD include as much of the original packet as possible (within the 576 byte limitation on the size of the ICMP packet). The motivation for this is to support sane handling of ICMP errors in tunneling scenarios.


I am not sure what definition you are referring to (source?), but it probably meant a 8 bit.

An ICMP packet is 8 bytes total[1], the first 16 bits are type and code bytes(eight bits in a byte); the type byte is given a number from 0 to 255[2], a different number representing a different type of sub-code.

As Zac67 stated the sender usually likes to know where the ICMP packet comes from, so it encapsulates it in an IP header, that IP header contains a field called 'protocol' when an ICMP packet is carried in the payload the protocol field is set[3] to 1 (0x01 in hex or 00000001 in binary), the protocol field is also bits (1 byte) long.

Below is some useful resources and sources. Hope this helps.





[1] - http://www.keyboardbanger.com/wp-content/uploads/2015/07/ICMP-header.png

[2] - https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Control_messages

[3] - https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

  • 3
    The real definition of ICMP is RFC 792, Internet Control Message Protocol. An ICMP message can certainly be longer than eight total bytes. In fact, it will include the IP header (20 bytes for IPv4) and the first 64 bits (eight bytes) of the IP payload: "The internet header plus the first 64 bits of the original datagram's data." That is enough to include the source and destination addresses of protocols like TCP or UDP.
    – Ron Maupin
    Commented Dec 9, 2018 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.