Let's take a look at the Internet Control Message Protocol (ICMP). It is one of the most popular protocols, and is better known for being used in ping commands, which is where an ICMP echo request is sent to an IP address with some random data, and it then denotes whether the system is alive. A typical ICMP packet would look like this:

The ICMP has many messages, which are identified by the Type of Message field. The Code field indicates the type of message. The Identifier and Sequence Number can be used by the client to match the reply with the request that caused the reply.

The Data field may contain a random string or a timestamp to compute the round-trip time in a stateless manner. Let's ping https://www.google.com/ and analyze it in Wireshark:

We can see that we have four Echo request and four Echo reply packets. Let's see the request first:

The request is of the Echo type and is denoted by the number 8, and the code is 0.

We can also see that the data starts with 09b and goes up to 48 bytes. Since we are pinging Google, if it's up, it will reply with the same data back to us. Let's see the response:

We can see that the data was sent back as is, which denotes that the system is up. Also, we can see that the Identifier and Sequence number are similar to the one in the request. The Type for the Echo reply is denoted by 0 and the code also remains zero. Let's see what happens when the IP is not reachable:

The preceding ping command denotes that there was a 100% loss of packets; let's see Wireshark:

We can see that Wireshark has not seen any response. Hence, it marked it as no response found.

So far, we have covered the basics of the TCP, UDP, and ICMP protocols. Let's see a case study and analyze the involved PCAP evidence file in the next section.