Chapter 5 · ICMP & NATThe student-friendly guide + hands-on Kali labs

Chapter 5 · The student-friendly guide

ICMP & NAT

Two helpers that keep IP usable: ICMP reports what went wrong, and NAT lets a whole private network share one public address.

ICMP MessagesPing & TraceroutePrivate NetworksNAT & PAT

Use ← → arrows, the dots, or the ☰ menu. Switch to the Lab Guide up top.

The big picture

Your 4-stop journey through Chapter 5

💡
Think of it like… a delivery service with two support desks: ICMP is the “sorry-we-missed-you / are-you-home?” notes desk, and NAT is the reception that lets a whole building share one public phone number.
💬
1

Why ICMP

IP can’t report errors. ICMP is its Layer-3 messenger.

✉️
2

ICMP messages

Query messages (are you there?) and error messages (something failed).

📡
3

Ping & Traceroute

The everyday tools that ride on ICMP.

🔁
4

Private nets & NAT

Reserved addresses, and how NAT/PAT shares public IPs.

Part 1 · Why ICMP

IP’s missing feedback channel

IP has two blind spots

● No error reporting
● No error correcting
IP just forwards, then forgets — if a packet dies, nobody is told.

ICMP fills the gap

● IP’s “companion” — part of Layer 3
● A messaging system: reports problems & answers queries
● Defined in RFC 792 · each message has a type code

💡
Think of it like… IP is a courier who never tells you what happened to your parcel. ICMP is the “sorry, we couldn’t deliver” card left in your mailbox — it doesn’t fix the problem, it just tells you about it.

Part 2 · ICMP Messages

Two families of message

Query (Informational)

● Ask a question, get an answer
● Always work in request/reply PAIRS
“Are you there? How long does it take?”

⚠️

Error (Troubleshooting)

● Report that something went wrong
● Sent to the ORIGINAL SOURCE only
“Couldn’t deliver. Time ran out.”

🧠
Memory hook: Query = a phone call (you ask, they answer — in pairs). Error = a returned letter stamped “undeliverable,” sent back only to the sender. Every message carries a numeric type code.

Part 2 · ICMP Messages

Query messages work in pairs

📡

Echo

Request (8) ⇄ Reply (0)

Test connectivity — this is what ping uses.

⏱️

Timestamp

Request (13) ⇄ Reply (14)

Measure Round-Trip Time (RTT).

🧭

Router (IPv6)

Solicitation (9) ⇄ Advert. (10)

Find an available router.

🧠
Memory hook: “Ping is 8 and 0.” Echo Request = type 8, Echo Reply = type 0 — like sonar: send a pulse out, listen for the echo back.

Part 2 · ICMP Messages

Error messages (sent to the source)

TypeMessageMeaning
3Destination UnreachableThe packet couldn’t be delivered.
11Time ExceededTTL hit 0, or a message is missing fragments.
5Redirect“Use this other router” — a better next hop exists.
12Parameter ProblemThe catch-all for any other header error.
4Source Quench“Slow down!” — now deprecated.

Type codes worth remembering: Destination Unreachable = 3 · Time Exceeded = 11.

Part 3 · Tools

Ping — “are you there?”

Ping is a TOOL, not ICMP itself. It uses ICMP Echo Request/Reply to test connectivity, device presence & addressing.

If it fails → you get an ICMP error, usually Destination Unreachable.

💡
Think of it like… sonar on a submarine: send a “ping” pulse and listen. Hear the echo back → the target is there.
💻 your PC
Echo Request (8) →
← Echo Reply (0)
🖥️ target

Part 3 · Tools

Traceroute — mapping the path

tracert / traceroute shows whether a route works, where it fails, and the IP of every router along the way.

ProbeWhat happensReveals
TTL = 1R1 drops it, replies Time ExceededR1
TTL = 2R2 drops it, replies Time ExceededR2
TTL = 3reaches the destination → it repliespath complete!
💡
Think of it like… breadcrumbs with a twist: send probes that “die” one hop further each time (TTL 1, 2, 3…). Each router that kills a probe reports back — so you collect the whole route, one stepping-stone at a time.

Self-Test #1

ICMP, Ping & Traceroute

Tap a green answer to reveal it.

Q What two things does IP lack that ICMP provides?
A Error reporting & feedback — IP has no built-in error reporting/correcting. ICMP is its messaging companion.
Q ICMP error messages are sent to whom?
A The original source only.
Q Which ICMP messages does ping use, and their type numbers?
A Echo Request (type 8) and Echo Reply (type 0).
Q What does Time Exceeded (type 11) indicate?
A TTL reached 0 (or a packet is missing fragments).

Part 4 · Private Nets & NAT

Private networks (RFC 1918)

Reserved address ranges anyone may use inside their own network — but never on the public Internet.

Class A
10.0.0.0 – 10.255.255.255
mask /8
Class B
172.16.0.0 – 172.31.255.255
mask /12
Class C
192.168.0.0 – 192.168.255.255
mask /16
💡
Think of it like… office extension numbers. Every company can have an “extension 101” internally — but you can’t dial it from outside. To reach the world, you go through the switchboard… which is exactly what NAT is.

Part 4 · Private Nets & NAT

NAT: sharing a public address

NAT (Network Address Translation) is a router function: at the border of a private network it swaps private IPs (and often ports) for globally routable public IPs — so many devices share a few public addresses.

private LAN
192.168.1.x ×N
NAT
router
one public IP
203.0.113.5
🌐
💡
Think of it like… a hotel’s front desk: every guest (private IP) shares the hotel’s single public phone number. The desk keeps a log so it can route each incoming reply back to the right room.

Part 4 · Private Nets & NAT

Four types of NAT

📌

Static

One internal IP ↔ one fixed external IP (a permanent 1-to-1).

🎰

Dynamic

One internal IP ↔ any free external IP from a pool.

👥

Overloading (PAT)

MANY internal IPs ↔ one external IP, using ports to tell them apart.

Overlapping

Fixes two networks that use the SAME IP range.

🧠
Memory hook: Static = a reserved parking spot (always yours). Dynamic = first free spot in the lot. Overloading/PAT = everyone shares one spot, tracked by ticket number (port). Overlapping = fixing two cars with the same plate.

Part 4 · NAT types

Static & Dynamic NAT

Static NAT — fixed 1:1

Each internal host always maps to the same dedicated public IP. Used for servers that must be reachable.

192.168.1.10 → 203.0.113.10
192.168.1.11 → 203.0.113.11

Dynamic NAT — from a pool

Each internal host borrows the next free public IP from a pool, then returns it. No fixed pairing.

pool: 203.0.113.20 – .29
192.168.1.50 → next free
💡
Think of it like… Static = your own reserved parking bay. Dynamic = a valet handing you whichever bay is free today — and you give it back when you leave.

Part 4 · NAT types

Overloading / PAT — the home-router trick

Many devices, ONE public IP. The router adds PORT translation so it can tell the conversations apart.

SourceSrc PortDestinationDest PortNAT Port
10.100.100.3105074.125.226.209801
10.100.100.50105074.125.226.209802

Two hosts use the SAME source port (1050) to the SAME server — the NAT Port (1 vs 2) keeps them unique so replies return correctly.

💡
Think of it like… one office phone number with a receptionist who gives each call a reference number (the port). When a reply comes in, she checks the log and patches it to the right person.

Part 4 · NAT types

Overlapping IPs — when ranges collide

The problem

Two networks use the SAME IP range — common after mergers, or moving to clouds (AWS/Azure/GCP). They can’t talk: addresses are ambiguous.

Net A
10.0.0.0/24
Net B
10.0.0.0/24

The NAT solution

NAT re-maps one (or both) sides to a different, non-clashing range as traffic crosses — so each sees the other at unique addresses.

10.0.0.0/24
172.16.5.0/24
💡
Think of it like… two merged companies that both used “extension 101.” NAT is the new switchboard that re-numbers one side, so a call to 101 is never ambiguous again.

Self-Test #2

Private Networks & NAT

Tap a green answer to reveal it.

Q Name the three private (RFC 1918) ranges.
A 10.0.0.0/8, 172.16.0.0–172.31.255.255, and 192.168.0.0/16.
Q What does NAT do, and where?
A At the border router it swaps private IPs (and often ports) for a public, routable IP.
Q Which NAT type lets many devices share ONE public IP, and how?
A Overloading / PAT — it adds port translation, using IP+port as a unique key.
Q Static vs Dynamic NAT?
A Static = a fixed 1-to-1 mapping; Dynamic = each internal IP borrows a public IP from a pool.

Part 4 · NAT types

Handy Cisco NAT commands

CommandWhat it does
show ip nat statisticsSee NAT counters & summary stats.
show ip nat translationsList all current static/dynamic NAT & PAT entries.
clear ip nat translation *Clear the dynamic NAT entries.
debug ip natWatch NAT translations happen in real time.

(On a Cisco router. On Linux, the equivalents live in iptables -t nat and conntrack.)

One-page cheat sheet

Chapter 5 in a single glance

Why ICMP

  • IP can’t report/correct errors
  • ICMP = its L3 messenger
  • RFC 792 · often blocked

2 families

  • Query (pairs): are you there?
  • Error: sent to source only
  • Each has a type code

Key types

  • Echo 8 / Reply 0 (ping)
  • Destination Unreachable = 3
  • Time Exceeded = 11

Ping

  • Tool using Echo Req/Reply
  • Tests reachability
  • Fail → Dest Unreachable

Traceroute

  • Increasing TTL per probe
  • Each router replies Time Exceeded
  • Reveals every hop’s IP

Private (RFC 1918)

  • 10.0.0.0/8
  • 172.16.0.0–172.31 (/12)
  • 192.168.0.0/16 · non-routable

NAT

  • Border router swaps
  • private IP → public IP
  • Many share few publics

NAT types

  • Static (1:1) · Dynamic (pool)
  • Overloading/PAT (1 IP + ports)
  • Overlapping (same-range fix)

PAT

  • IP + port = unique key
  • Home-router default
  • Reversed on the way back

Report it. Translate it. Done.

You can now read any ICMP message, explain how ping & traceroute work, and trace how NAT lets a private network reach the whole Internet. Revise with the cheat sheet, test yourself with the quizzes.

Next up → Chapter 6 (Subnetting)

Ready to make it real? Switch to the 🧪 Lab Guide — fire ICMP, run traceroute, and prove you’re behind NAT on Kali Linux.

1 / 19

Chapter 5 · Hands-on labs

ICMP & NAT — live on Kali Linux

Six small, beginner-friendly labs using only built-in Linux commands. Fire ICMP and watch the replies, map a path with traceroute, then prove your own machine is hiding behind NAT — type the command, read the output.

SET-UP  ·  Open the Kali Terminal. A couple of labs use two terminals (A & B). Capturing needs sudo. Everything is built into Kali (ping, traceroute, tcpdump, ip, ss, curl). The is just the prompt — Copy grabs only the command. Replace eth0 with your interface if it differs.
USE RESPONSIBLY  ·  Only send traffic to / capture on networks you own or are allowed to test. These labs use your own machine, your gateway, and public test hosts.
1 · Ping = ICMP2 · ICMP errors3 · Traceroute 4 · Behind NAT5 · PAT & ports6 · NAT types✓ Answers
1

Ping Is ICMP Echo

Maps to Ch.5:Ping uses ICMP Echo Request (type 8) and Echo Reply (type 0) — the classic query pair. You’ll learn:Fire a ping and watch the ICMP Echo request & reply on the wire. Tools:ping, tcpdump (two terminals)
1

Start watching ICMP in Terminal A:

sudo tcpdump -i any -nn -c 4 icmp
2

Send two pings in Terminal B:

ping -c 2 8.8.8.8
3

Read Terminal A — request out, reply back:

Verified format — the two halves of the pair
IP 192.168.1.23 > 8.8.8.8: ICMP echo request, id 12, seq 1
IP 8.8.8.8 > 192.168.1.23: ICMP echo reply,   id 12, seq 1
Why it matters  ·  “Ping” isn’t a protocol — it’s a tool that sends an ICMP Echo Request (8) and waits for an Echo Reply (0). tcpdump labels them in plain English, so you can see the query pair the slide describes.
Your turn  ·  In the output, which line is the request and which is the reply — and how can you tell from the direction? (answer below)
2

ICMP Error Messages

Maps to Ch.5:Error messages — Time Exceeded (type 11) and Destination Unreachable (type 3), sent back to the source. You’ll learn:Trigger both of the famous ICMP errors on purpose and read them. Tools:ping
1

Time Exceeded (type 11) — send a packet with only ONE hop of life (-t 1):

ping -c 1 -t 1 8.8.8.8
Representative — the first router reports back
From 192.168.1.1 icmp_seq=1 Time to live exceeded
2

Destination Unreachable (type 3) — ping an address that can’t be reached:

ping -c 2 192.0.2.1
Representative — unreachable / no route
From 192.168.1.1 icmp_seq=1 Destination Host Unreachable
Why it matters  ·  These are ICMP error messages — and notice they come back to you (the source), exactly as the slide says. Type 11 (TTL ran out) and Type 3 (couldn’t deliver) are the two you’ll meet most.
Your turn  ·  Which device sent the “Time to live exceeded” message — and why was it that one and not 8.8.8.8? (answer below)
3

Traceroute Rides on ICMP

Maps to Ch.5:Traceroute uses the TTL trick + ICMP Time Exceeded to reveal every router on the path. You’ll learn:Map the route to a far host and watch the latency climb hop by hop. Tools:traceroute (sudo apt install traceroute)
1

Trace the path to a distant site (-n skips name lookups, so it’s faster):

traceroute -n 8.8.8.8
Representative — each line is one router
1  192.168.1.1     1.0 ms     <- your gateway
2  10.20.30.1      8.4 ms     <- your ISP
3  100.66.0.5      12.1 ms    <- ISP core
...
7  8.8.8.8         30.2 ms    <- destination
Why it matters  ·  Traceroute sends probes with TTL 1, then 2, then 3… Each router that hits TTL 0 replies with ICMP Time Exceeded, revealing itself — so the whole path appears, one hop at a time. It’s the exact trick from Chapter 4’s TTL lab, put to work.
Your turn  ·  Compare hop 1’s time with the last hop’s. Why does latency grow as you go further? (answer below)
4

Behind NAT: Private vs Public IP

Maps to Ch.5:NAT — your device has a PRIVATE IP, but the Internet sees a different PUBLIC IP (your router’s). You’ll learn:Prove NAT is happening: compare the address on your card to the one the world sees. Tools:ip, curl
1

Your PRIVATE address — what your machine actually has:

ip -br addr show eth0
Representative — a private (RFC 1918) address
eth0    UP    192.168.1.23/24
2

Your PUBLIC address — what a website on the Internet sees:

curl -s ifconfig.me; echo
Representative — your router’s public IP
203.0.113.45
Why it matters  ·  The two addresses are different — that gap IS NAT. Your private 192.168.x.x can’t travel the public Internet, so your router swaps it for its one public IP on the way out (and swaps it back on the way in).
Your turn  ·  Are your two addresses the same or different? Which one would your phone on the same Wi-Fi also share? (answer below)
5

PAT: One Public IP, Many Ports

Maps to Ch.5:Overloading / PAT — many devices & connections share one public IP, kept apart by port numbers. You’ll learn:See your own connections, each with a unique local port — the key PAT uses to tell them apart. Tools:ss, curl
1

Open a few connections (run this to create some traffic):

curl -s example.com -o /dev/null & curl -s example.org -o /dev/null &
2

List your TCP connections — look at the local port on each line:

ss -tn
Representative — each connection has its OWN local port
State  Local Address:Port      Peer Address:Port
ESTAB  192.168.1.23:51234     93.184.216.34:80
ESTAB  192.168.1.23:51236     104.26.12.5:80
Why it matters  ·  Every connection from your machine uses a different local port (51234, 51236…). That’s the trick PAT relies on: the router replaces your private IP with its public IP and uses these ports as unique keys — so when replies come back, it knows exactly which device & connection to send them to.
Your turn  ·  If two of your connections went to the SAME website, what would keep them apart in the router’s table? (answer below)
6

The Four NAT Types in the Wild

Maps to Ch.5:Static, Dynamic, Overloading/PAT, Overlapping — recognising which is which in real life. You’ll learn:Spot the PAT your home router does, and a server’s stable (static-style) public IP. Tools:dig, ss
1

A public server has a fixed public IP (a static-NAT-style, always-reachable address):

dig +short example.com
Representative
93.184.216.34
2

Your home router does PAT — recall Lab 4 (one public IP) + Lab 5 (many ports). That combination IS overloading/PAT:

ss -tn | head
The four types, in plain terms  ·  Static = a server with a permanent public IP (like the one dig returned). Dynamic = a pool of public IPs handed out as needed. Overloading / PAT = your home router — many devices, one public IP, separated by ports. Overlapping = two networks with the same range, fixed by re-mapping one side.
Why it matters  ·  Almost every home and small office uses PAT — it’s why a dozen devices can browse at once through a single public address. The other three you’ll meet in servers, ISPs and mergers.
Your turn  ·  Which NAT type is your phone, laptop and TV all using to share the home Wi-Fi’s one public IP? (answer below)

Answer Key & Where Next

Lab 1. The line 192.168… > 8.8.8.8 … echo request is your request (going out); 8.8.8.8 > 192.168… echo reply is the reply (coming back). The direction of the > gives it away.

Lab 2. Your gateway (the first router) sent “Time to live exceeded” — because TTL was 1, it decremented to 0 at the very first hop, so 8.8.8.8 was never reached.

Lab 3. Latency grows with distance: more routers and longer physical links between you and the destination each add a little delay (LAN → ISP → backbone → far host).

Lab 4. They’re different — private inside, public outside. Every device on the same Wi-Fi (your phone, laptop, TV) shares that same public IP, courtesy of NAT.

Lab 5. The port numbers — even two connections to the same site have different local ports, so the router’s PAT table keeps them unique (IP + port = the key).

Lab 6. Overloading / PAT — many devices sharing one public IP, told apart by ports. It’s the default on virtually every home router.

This lab’s toolConnects to…
ping / ICMP (Lab 1, 2)Chapter 4 — TTL & the IP header (ICMP rides on IP)
traceroute (Lab 3)Chapter 4 — the TTL trick, now revealing the path
private vs public (Lab 4–6)Chapter 4 — RFC 1918 private ranges, now translated
ss / ports (Lab 5)Transport layer — ports identify each conversation
Nice work  ·  With nothing but built-in Linux commands you’ve fired ICMP and read the replies, triggered both classic ICMP errors, mapped a route, and proved your own machine is hiding behind NAT.
Chapter 5 — ICMP & NAT · Slides + Hands-On Kali Labs