Two helpers that keep IP usable: ICMP reports what went wrong, and NAT lets a whole private network share one public address.
ICMP MessagesPing & TraceroutePrivate NetworksNAT & PAT
Use ← → arrows, the dots, or the ☰ menu. Switch to the Lab Guide up top.
The big picture
Your 4-stop journey through Chapter 5
💡
Think of it like… a delivery service with two support desks: ICMP is the “sorry-we-missed-you / are-you-home?” notes desk, and NAT is the reception that lets a whole building share one public phone number.
💬
1
Why ICMP
IP can’t report errors. ICMP is its Layer-3 messenger.
✉️
2
ICMP messages
Query messages (are you there?) and error messages (something failed).
📡
3
Ping & Traceroute
The everyday tools that ride on ICMP.
🔁
4
Private nets & NAT
Reserved addresses, and how NAT/PAT shares public IPs.
Part 1 · Why ICMP
IP’s missing feedback channel
IP has two blind spots
● No error reporting ● No error correcting IP just forwards, then forgets — if a packet dies, nobody is told.
ICMP fills the gap
● IP’s “companion” — part of Layer 3 ● A messaging system: reports problems & answers queries ● Defined in RFC 792 · each message has a type code
💡
Think of it like… IP is a courier who never tells you what happened to your parcel. ICMP is the “sorry, we couldn’t deliver” card left in your mailbox — it doesn’t fix the problem, it just tells you about it.
Part 2 · ICMP Messages
Two families of message
❓
Query (Informational)
● Ask a question, get an answer ● Always work in request/reply PAIRS “Are you there? How long does it take?”
⚠️
Error (Troubleshooting)
● Report that something went wrong ● Sent to the ORIGINAL SOURCE only “Couldn’t deliver. Time ran out.”
🧠
Memory hook: Query = a phone call (you ask, they answer — in pairs). Error = a returned letter stamped “undeliverable,” sent back only to the sender. Every message carries a numeric type code.
Part 2 · ICMP Messages
Query messages work in pairs
📡
Echo
Request (8) ⇄ Reply (0)
Test connectivity — this is what ping uses.
⏱️
Timestamp
Request (13) ⇄ Reply (14)
Measure Round-Trip Time (RTT).
🧭
Router (IPv6)
Solicitation (9) ⇄ Advert. (10)
Find an available router.
🧠
Memory hook: “Ping is 8 and 0.” Echo Request = type 8, Echo Reply = type 0 — like sonar: send a pulse out, listen for the echo back.
Part 2 · ICMP Messages
Error messages (sent to the source)
Type
Message
Meaning
3
Destination Unreachable
The packet couldn’t be delivered.
11
Time Exceeded
TTL hit 0, or a message is missing fragments.
5
Redirect
“Use this other router” — a better next hop exists.
12
Parameter Problem
The catch-all for any other header error.
4
Source Quench
“Slow down!” — now deprecated.
Type codes worth remembering: Destination Unreachable = 3 · Time Exceeded = 11.
Part 3 · Tools
Ping — “are you there?”
Ping is a TOOL, not ICMP itself. It uses ICMP Echo Request/Reply to test connectivity, device presence & addressing.
If it fails → you get an ICMP error, usually Destination Unreachable.
💡
Think of it like… sonar on a submarine: send a “ping” pulse and listen. Hear the echo back → the target is there.
💻 your PC
Echo Request (8) →
← Echo Reply (0)
🖥️ target
Part 3 · Tools
Traceroute — mapping the path
tracert / traceroute shows whether a route works, where it fails, and the IP of every router along the way.
Probe
What happens
Reveals
TTL = 1
R1 drops it, replies Time Exceeded
R1
TTL = 2
R2 drops it, replies Time Exceeded
R2
TTL = 3
reaches the destination → it replies
path complete!
💡
Think of it like… breadcrumbs with a twist: send probes that “die” one hop further each time (TTL 1, 2, 3…). Each router that kills a probe reports back — so you collect the whole route, one stepping-stone at a time.
Self-Test #1
ICMP, Ping & Traceroute
Tap a green answer to reveal it.
Q What two things does IP lack that ICMP provides?
A Error reporting & feedback — IP has no built-in error reporting/correcting. ICMP is its messaging companion.
Q ICMP error messages are sent to whom?
A The original source only.
Q Which ICMP messages does ping use, and their type numbers?
A Echo Request (type 8) and Echo Reply (type 0).
Q What does Time Exceeded (type 11) indicate?
A TTL reached 0 (or a packet is missing fragments).
Part 4 · Private Nets & NAT
Private networks (RFC 1918)
Reserved address ranges anyone may use inside their own network — but never on the public Internet.
Class A
10.0.0.0 – 10.255.255.255
mask /8
Class B
172.16.0.0 – 172.31.255.255
mask /12
Class C
192.168.0.0 – 192.168.255.255
mask /16
💡
Think of it like… office extension numbers. Every company can have an “extension 101” internally — but you can’t dial it from outside. To reach the world, you go through the switchboard… which is exactly what NAT is.
Part 4 · Private Nets & NAT
NAT: sharing a public address
NAT (Network Address Translation) is a router function: at the border of a private network it swaps private IPs (and often ports) for globally routable public IPs — so many devices share a few public addresses.
private LAN 192.168.1.x ×N
NAT router
one public IP 203.0.113.5
🌐
💡
Think of it like… a hotel’s front desk: every guest (private IP) shares the hotel’s single public phone number. The desk keeps a log so it can route each incoming reply back to the right room.
Part 4 · Private Nets & NAT
Four types of NAT
📌
Static
One internal IP ↔ one fixed external IP (a permanent 1-to-1).
🎰
Dynamic
One internal IP ↔ any free external IP from a pool.
👥
Overloading (PAT)
MANY internal IPs ↔ one external IP, using ports to tell them apart.
⧉
Overlapping
Fixes two networks that use the SAME IP range.
🧠
Memory hook: Static = a reserved parking spot (always yours). Dynamic = first free spot in the lot. Overloading/PAT = everyone shares one spot, tracked by ticket number (port). Overlapping = fixing two cars with the same plate.
Part 4 · NAT types
Static & Dynamic NAT
Static NAT — fixed 1:1
Each internal host always maps to the same dedicated public IP. Used for servers that must be reachable.
Each internal host borrows the next free public IP from a pool, then returns it. No fixed pairing.
pool: 203.0.113.20 – .29 192.168.1.50 → next free
💡
Think of it like… Static = your own reserved parking bay. Dynamic = a valet handing you whichever bay is free today — and you give it back when you leave.
Part 4 · NAT types
Overloading / PAT — the home-router trick
Many devices, ONE public IP. The router adds PORT translation so it can tell the conversations apart.
Source
Src Port
Destination
Dest Port
NAT Port
10.100.100.3
1050
74.125.226.209
80
1
10.100.100.50
1050
74.125.226.209
80
2
Two hosts use the SAME source port (1050) to the SAME server — the NAT Port (1 vs 2) keeps them unique so replies return correctly.
💡
Think of it like… one office phone number with a receptionist who gives each call a reference number (the port). When a reply comes in, she checks the log and patches it to the right person.
Part 4 · NAT types
Overlapping IPs — when ranges collide
The problem
Two networks use the SAME IP range — common after mergers, or moving to clouds (AWS/Azure/GCP). They can’t talk: addresses are ambiguous.
Net A 10.0.0.0/24
⚡
Net B 10.0.0.0/24
The NAT solution
NAT re-maps one (or both) sides to a different, non-clashing range as traffic crosses — so each sees the other at unique addresses.
10.0.0.0/24
172.16.5.0/24
💡
Think of it like… two merged companies that both used “extension 101.” NAT is the new switchboard that re-numbers one side, so a call to 101 is never ambiguous again.
Self-Test #2
Private Networks & NAT
Tap a green answer to reveal it.
Q Name the three private (RFC 1918) ranges.
A 10.0.0.0/8, 172.16.0.0–172.31.255.255, and 192.168.0.0/16.
Q What does NAT do, and where?
A At the border router it swaps private IPs (and often ports) for a public, routable IP.
Q Which NAT type lets many devices share ONE public IP, and how?
A Overloading / PAT — it adds port translation, using IP+port as a unique key.
Q Static vs Dynamic NAT?
A Static = a fixed 1-to-1 mapping; Dynamic = each internal IP borrows a public IP from a pool.
Part 4 · NAT types
Handy Cisco NAT commands
Command
What it does
show ip nat statistics
See NAT counters & summary stats.
show ip nat translations
List all current static/dynamic NAT & PAT entries.
clear ip nat translation *
Clear the dynamic NAT entries.
debug ip nat
Watch NAT translations happen in real time.
(On a Cisco router. On Linux, the equivalents live in iptables -t nat and conntrack.)
One-page cheat sheet
Chapter 5 in a single glance
Why ICMP
IP can’t report/correct errors
ICMP = its L3 messenger
RFC 792 · often blocked
2 families
Query (pairs): are you there?
Error: sent to source only
Each has a type code
Key types
Echo 8 / Reply 0 (ping)
Destination Unreachable = 3
Time Exceeded = 11
Ping
Tool using Echo Req/Reply
Tests reachability
Fail → Dest Unreachable
Traceroute
Increasing TTL per probe
Each router replies Time Exceeded
Reveals every hop’s IP
Private (RFC 1918)
10.0.0.0/8
172.16.0.0–172.31 (/12)
192.168.0.0/16 · non-routable
NAT
Border router swaps
private IP → public IP
Many share few publics
NAT types
Static (1:1) · Dynamic (pool)
Overloading/PAT (1 IP + ports)
Overlapping (same-range fix)
PAT
IP + port = unique key
Home-router default
Reversed on the way back
Report it. Translate it. Done.
You can now read any ICMP message, explain how ping & traceroute work, and trace how NAT lets a private network reach the whole Internet. Revise with the cheat sheet, test yourself with the quizzes.
Next up → Chapter 6 (Subnetting)
Ready to make it real? Switch to the 🧪 Lab Guide — fire ICMP, run traceroute, and prove you’re behind NAT on Kali Linux.
1 / 19
Chapter 5 · Hands-on labs
ICMP & NAT — live on Kali Linux
Six small, beginner-friendly labs using only built-in Linux commands. Fire ICMP and watch the replies, map a path with traceroute, then prove your own machine is hiding behind NAT — type the command, read the output.
SET-UP · Open the Kali Terminal. A couple of labs use two terminals (A & B). Capturing needs sudo. Everything is built into Kali (ping, traceroute, tcpdump, ip, ss, curl). The ❯ is just the prompt — Copy grabs only the command. Replace eth0 with your interface if it differs.
USE RESPONSIBLY · Only send traffic to / capture on networks you own or are allowed to test. These labs use your own machine, your gateway, and public test hosts.
Maps to Ch.5:Ping uses ICMP Echo Request (type 8) and Echo Reply (type 0) — the classic query pair.You’ll learn:Fire a ping and watch the ICMP Echo request & reply on the wire.Tools:ping, tcpdump (two terminals)
1
Start watching ICMP in Terminal A:
sudo tcpdump -i any -nn -c 4 icmp
2
Send two pings in Terminal B:
ping -c 2 8.8.8.8
3
Read Terminal A — request out, reply back:
Verified format — the two halves of the pair
IP 192.168.1.23 > 8.8.8.8: ICMP echo request, id 12, seq 1
IP 8.8.8.8 > 192.168.1.23: ICMP echo reply, id 12, seq 1
Why it matters · “Ping” isn’t a protocol — it’s a tool that sends an ICMP Echo Request (8) and waits for an Echo Reply (0). tcpdump labels them in plain English, so you can see the query pair the slide describes.
Your turn · In the output, which line is the request and which is the reply — and how can you tell from the direction? (answer below)
2
ICMP Error Messages
Maps to Ch.5:Error messages — Time Exceeded (type 11) and Destination Unreachable (type 3), sent back to the source.You’ll learn:Trigger both of the famous ICMP errors on purpose and read them.Tools:ping
1
Time Exceeded (type 11) — send a packet with only ONE hop of life (-t 1):
ping -c 1 -t 1 8.8.8.8
Representative — the first router reports back
From 192.168.1.1 icmp_seq=1 Time to live exceeded
2
Destination Unreachable (type 3) — ping an address that can’t be reached:
ping -c 2 192.0.2.1
Representative — unreachable / no route
From 192.168.1.1 icmp_seq=1 Destination Host Unreachable
Why it matters · These are ICMP error messages — and notice they come back to you (the source), exactly as the slide says. Type 11 (TTL ran out) and Type 3 (couldn’t deliver) are the two you’ll meet most.
Your turn · Which device sent the “Time to live exceeded” message — and why was it that one and not 8.8.8.8? (answer below)
3
Traceroute Rides on ICMP
Maps to Ch.5:Traceroute uses the TTL trick + ICMP Time Exceeded to reveal every router on the path.You’ll learn:Map the route to a far host and watch the latency climb hop by hop.Tools:traceroute (sudo apt install traceroute)
1
Trace the path to a distant site (-n skips name lookups, so it’s faster):
traceroute -n 8.8.8.8
Representative — each line is one router
1 192.168.1.1 1.0 ms <- your gateway
2 10.20.30.1 8.4 ms <- your ISP
3 100.66.0.5 12.1 ms <- ISP core
...
7 8.8.8.8 30.2 ms <- destination
Why it matters · Traceroute sends probes with TTL 1, then 2, then 3… Each router that hits TTL 0 replies with ICMP Time Exceeded, revealing itself — so the whole path appears, one hop at a time. It’s the exact trick from Chapter 4’s TTL lab, put to work.
Your turn · Compare hop 1’s time with the last hop’s. Why does latency grow as you go further? (answer below)
4
Behind NAT: Private vs Public IP
Maps to Ch.5:NAT — your device has a PRIVATE IP, but the Internet sees a different PUBLIC IP (your router’s).You’ll learn:Prove NAT is happening: compare the address on your card to the one the world sees.Tools:ip, curl
1
Your PRIVATE address — what your machine actually has:
ip -br addr show eth0
Representative — a private (RFC 1918) address
eth0 UP 192.168.1.23/24
2
Your PUBLIC address — what a website on the Internet sees:
curl -s ifconfig.me; echo
Representative — your router’s public IP
203.0.113.45
Why it matters · The two addresses are different — that gap IS NAT. Your private 192.168.x.x can’t travel the public Internet, so your router swaps it for its one public IP on the way out (and swaps it back on the way in).
Your turn · Are your two addresses the same or different? Which one would your phone on the same Wi-Fi also share? (answer below)
5
PAT: One Public IP, Many Ports
Maps to Ch.5:Overloading / PAT — many devices & connections share one public IP, kept apart by port numbers.You’ll learn:See your own connections, each with a unique local port — the key PAT uses to tell them apart.Tools:ss, curl
1
Open a few connections (run this to create some traffic):
List your TCP connections — look at the local port on each line:
ss -tn
Representative — each connection has its OWN local port
State Local Address:Port Peer Address:Port
ESTAB 192.168.1.23:51234 93.184.216.34:80
ESTAB 192.168.1.23:51236 104.26.12.5:80
Why it matters · Every connection from your machine uses a different local port (51234, 51236…). That’s the trick PAT relies on: the router replaces your private IP with its public IP and uses these ports as unique keys — so when replies come back, it knows exactly which device & connection to send them to.
Your turn · If two of your connections went to the SAME website, what would keep them apart in the router’s table? (answer below)
6
The Four NAT Types in the Wild
Maps to Ch.5:Static, Dynamic, Overloading/PAT, Overlapping — recognising which is which in real life.You’ll learn:Spot the PAT your home router does, and a server’s stable (static-style) public IP.Tools:dig, ss
1
A public server has a fixed public IP (a static-NAT-style, always-reachable address):
dig +short example.com
Representative
93.184.216.34
2
Your home router does PAT — recall Lab 4 (one public IP) + Lab 5 (many ports). That combination IS overloading/PAT:
ss -tn | head
The four types, in plain terms · Static = a server with a permanent public IP (like the one dig returned). Dynamic = a pool of public IPs handed out as needed. Overloading / PAT = your home router — many devices, one public IP, separated by ports. Overlapping = two networks with the same range, fixed by re-mapping one side.
Why it matters · Almost every home and small office uses PAT — it’s why a dozen devices can browse at once through a single public address. The other three you’ll meet in servers, ISPs and mergers.
Your turn · Which NAT type is your phone, laptop and TV all using to share the home Wi-Fi’s one public IP? (answer below)
✓
Answer Key & Where Next
Lab 1. The line 192.168… > 8.8.8.8 … echo request is your request (going out); 8.8.8.8 > 192.168… echo reply is the reply (coming back). The direction of the > gives it away.
Lab 2. Your gateway (the first router) sent “Time to live exceeded” — because TTL was 1, it decremented to 0 at the very first hop, so 8.8.8.8 was never reached.
Lab 3. Latency grows with distance: more routers and longer physical links between you and the destination each add a little delay (LAN → ISP → backbone → far host).
Lab 4. They’re different — private inside, public outside. Every device on the same Wi-Fi (your phone, laptop, TV) shares that same public IP, courtesy of NAT.
Lab 5. The port numbers — even two connections to the same site have different local ports, so the router’s PAT table keeps them unique (IP + port = the key).
Lab 6.Overloading / PAT — many devices sharing one public IP, told apart by ports. It’s the default on virtually every home router.
This lab’s tool
Connects to…
ping / ICMP (Lab 1, 2)
Chapter 4 — TTL & the IP header (ICMP rides on IP)
traceroute (Lab 3)
Chapter 4 — the TTL trick, now revealing the path
private vs public (Lab 4–6)
Chapter 4 — RFC 1918 private ranges, now translated
ss / ports (Lab 5)
Transport layer — ports identify each conversation
Nice work · With nothing but built-in Linux commands you’ve fired ICMP and read the replies, triggered both classic ICMP errors, mapped a route, and proved your own machine is hiding behind NAT.