Can a Internet Control Message Protocol when an error is sent can it tell which datagram that made the error?


In many cases, an ICMP error message contains the header of the packet that caused the error.

Example: The ICMP Type3 Code 3 "Port Unreachable" response from a "server" ( to an unsolicited UDP packet generated with iperf2 from a "client" ( 1

The blue frame shows the packet that caused the error; the error in this case was that the responding system did not have an open socket on port udp/5001 (because iperf2 was not running on the responding system).

Wireshark packet analysis/dissection of an ICMP type code 3 "port unreachable" message

1 Please note that neither ICMP, UDP nor TCP have a concept of client or server - these are application layer concepts. If at all, there is the notion of an initiator and responder.


An ICMP error message will contain the IP header and first 64 bits (eight octets) of the original data. See RFC 792, Internet Message Control Protocol:

Internet Header + 64 bits of Data Datagram

The internet header plus the first 64 bits of the original datagram's data. This data is used by the host to match the message to the appropriate process. If a higher level protocol uses port numbers, they are assumed to be in the first 64 data bits of the original datagram's data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.