Lesson 3.10: UDP and ICMP: fast messages and network signals
UDP, the transport protocol without connections or delivery guarantees, and why DNS, video calls, games and time sync use it; ICMP, the network's own messages (echo request and reply, destination unreachable, time exceeded) that ping and traceroute are built on; and the attacks that come with them: spoofed UDP and amplification, ICMP used for scanning. In the lab you see a DNS question and answer travel as two lone UDP packets, read ICMP echo, time-exceeded and port-unreachable messages, and test a UDP port.
17 min
You will learn to
- Explain how UDP differs from TCP and when it's used
- Read a DNS exchange over UDP
- Name the main ICMP message types
- Explain how ping and traceroute use ICMP
- Explain reflection and amplification attacks
Key terms
- UDP
- A connectionless transport protocol: each message is sent on its own, with no handshake, no acknowledgement and no re-sending.
- Datagram
- One self-contained UDP message.
- ICMP
- The network's control and error messages, sent by hosts and routers about other packets.
- Echo request and reply
- An ICMP 'are you there?' and 'yes', used by ping.
- Destination unreachable
- An ICMP message saying a packet couldn't be delivered: no route, host down, or (for UDP) nothing on that port.
- Time exceeded
- Sent by a router that dropped a packet whose TTL reached zero; traceroute relies on it.
- Reflection and amplification
- A denial-of-service technique: send small UDP questions with the victim's address forged as the sender to servers that give big answers, so the answers flood the victim.
← Spaces in paths and file names · All lessons · Authentication, authorisation, accounting and MFA →