Guides2026-11-08•11 min read

ICMP, Ping & Traceroute Explained: How TTL Exceeded and Destination Unreachable Work

BrainyTools Editor

Tech Contributor at BrainyTools

ICMP, Ping & Traceroute Explained: How TTL Exceeded and Destination Unreachable Work

Why does a Cisco router print U.U.U on one failed ping and ..... on another? And how does tracert discover the IPv4 address of every intermediate router along a path without any special router configuration? The answer is ICMP.

Standardized in IETF RFC 792 (Internet Control Message Protocol, J. Postel, September 1981), ICMP (Internet Control Message Protocol) is the built-in diagnostic and error-reporting protocol of the IPv4 Layer-3 suite.

Although ICMP messages are encapsulated directly inside an IPv4 packet payload (with IPv4 Header Protocol = 1), ICMP is considered a Layer-3 (Network Layer) control protocol rather than a Layer-4 transport protocol because it does not use TCP/UDP port numbers and does not carry user application data. Instead, routers and hosts use ICMP to test end-to-end reachability (ping), discover hop-by-hop routing paths (tracert / traceroute), and report delivery failures (Destination Unreachable and TTL Exceeded).

In this guide, we examine the core RFC 792 ICMP message types, how Cisco IOS vs. PC ping outputs differ, how tracert manipulates the IPv4 Time to Live (TTL) field, and how to watch each ICMP message live in the Web Packet Tracer & Network Simulator.

1. Core ICMPv4 Message Types (RFC 792) for the CCNA Exam

Every ICMPv4 header starts with an 8-bit Type field, an 8-bit Code field, and a 16-bit Checksum:

ICMP Type	ICMP Code	Official RFC 792 Name	Simulator Trace Summary	What Triggers It
Type `8`	Code `0`	Echo Request	`ICMP echo-request`	Sent by `ping` (and Windows `tracert`) to test reachability to a destination IP.
Type `0`	Code `0`	Echo Reply	`ICMP echo-reply`	Sent by the target host or router in response to receiving an ICMP Echo Request (`Type 8`).
Type `3`	Code `0–15`	Destination Unreachable	`ICMP dest-unreachable`	Sent by a router (e.g., Code `0` = Network Unreachable, Code `1` = Host Unreachable) when no route exists in `show ip route`, or by a host when no local gateway is set.
Type `11`	Code `0`	Time Exceeded (TTL Expired in Transit)	`ICMP ttl-exceeded`	Sent by an intermediate router when a transit IPv4 packet arrives with `TTL <= 1` (so decrementing TTL reaches `0`).

2. Decoding Cisco IOS vs. PC `ping` Output

When you run ping <ip> from a PC command prompt vs. a Cisco IOS router console in Web Packet Tracer, the defaults and output indicators match real-world platforms:

PC Command Prompt (`C:\> ping <ip>`)

Sends 4 ICMP Echo Requests (32 bytes each) with a default initial TTL of 128 (Windows standard).
Prints human-readable status messages for each probe:
- Reply from 10.0.0.10: bytes=32 time=1600ms TTL=127 — Received an ICMP Echo Reply (Type 0). Notice the returned TTL (127) is 128 minus the number of router hops (1)!
- Reply from 192.168.1.1: Destination host unreachable. — Either the PC has no default gateway configured for a foreign subnet, or router 192.168.1.1 returned an ICMP Destination Unreachable (Type 3) message because it had no route to the destination.
- Reply from 10.0.12.2: TTL expired in transit. — An intermediate router (10.0.12.2) decremented the packet's TTL to 0 (usually caused by a routing loop!) and returned an ICMP Time Exceeded (Type 11) message.
- Request timed out. — No ICMP response was received before the timeout timer expired (for example, ARP failed on the destination LAN, an interface is down, or the return path back to the sender is missing).

Cisco IOS Router (`R1# ping <ip>`)

Sends 5 ICMP Echo Requests (100 bytes each) with a default initial TTL of 255 (Cisco IOS standard):

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 800/880/1200 ms

Every CCNA candidate must know the three primary Cisco IOS ping result characters:
- ! (Exclamation Point): Successful receipt of an ICMP Echo Reply (Type 0).
- . (Period / Dot): Request Timed Out—the router waited for the timeout interval without receiving any reply.
- U (Uppercase U): Destination Unreachable—an ICMP Destination Unreachable (Type 3) message was received (or the local router had no matching route/active egress interface to transmit the probe).

3. How `tracert` / `traceroute` Uses TTL Exceeded to Map Every Hop

How does tracert 192.168.2.10 discover the IP address of every router between PC1 and PC2 when an IPv4 packet only has room for a single Source IP and a single Destination IP?

It uses a clever manipulation of the 8-bit IPv4 TTL (Time to Live) header field:

Hop 1 Probe:  PC1 sends Echo Request to 192.168.2.10 with TTL = 1
              ├──► Arrives at R1 (192.168.1.1). R1 sees TTL=1, decrements to 0, drops packet!
              └──◄ R1 sends ICMP "ttl-exceeded" (Src IP = 192.168.1.1) back to PC1.
                   (PC1 records Hop 1 = 192.168.1.1!)

Hop 2 Probe:  PC1 sends Echo Request to 192.168.2.10 with TTL = 2
              ├──► Arrives at R1 (decrements TTL 2 → 1) and forwards to R2 (10.0.12.2).
              ├──► R2 sees TTL=1, decrements to 0, drops packet!
              └──◄ R2 sends ICMP "ttl-exceeded" (Src IP = 10.0.12.2) back to PC1.
                   (PC1 records Hop 2 = 10.0.12.2!)

Hop 3 Probe:  PC1 sends Echo Request to 192.168.2.10 with TTL = 3
              ├──► R1 (TTL 3 → 2) ──► R2 (TTL 2 → 1) ──► Arrives at PC2 (192.168.2.10)!
              └──◄ Because PC2 IS the destination IP, PC2 does not decrement TTL;
                   PC2 replies with ICMP "echo-reply" (Src IP = 192.168.2.10).
                   (PC1 records Hop 3 = 192.168.2.10 and finishes: "Trace complete.")

(Note for CCNA Exam: Windows tracert sends ICMP Echo Requests (Type 8), whereas Cisco IOS and Linux traceroute by default send UDP datagrams to high-numbered invalid ports 33434+ so intermediate routers return ICMP TTL Exceeded (Type 11) and the final destination host returns ICMP Destination Unreachable — Port Unreachable (Type 3, Code 3).)

4. Hands-On Lab: Triggering `Reply`, `Unreachable`, `TTL Exceeded` & `tracert`

Open the Web Packet Tracer & Network Simulator and click Load Sample Topology:

Test Normal Ping & tracert:
- Select the PC1 console tab and run:
```
C:\> tracert 10.0.0.10
```
- Observe the two hops:
```
Tracing route to 10.0.0.10 over a maximum of 8 hops:

  1    1600 ms   192.168.1.1
  2    3200 ms   10.0.0.10

Trace complete.
```
- Look at the Packet Trace Event Log on the right: for ttl=1, R1 logged DROP (TTL expired from 192.168.1.10 to 10.0.0.10) (rose badge) and transmitted ICMP ttl-exceeded 192.168.1.1 -> 192.168.1.10!
Trigger Destination host unreachable (ICMP dest-unreachable):
- From PC1, ping an IP address in a subnet that R1 has no route to:
```
C:\> ping 172.16.99.99
```
- Watch R1 receive the packet, check its routing table, log DROP (No route to 172.16.99.99), and return ICMP dest-unreachable 192.168.1.1 -> 192.168.1.10!
- On PC1, the terminal prints: Reply from 192.168.1.1: Destination host unreachable.
- Now select the R1 tab and run ping 172.16.99.99 from Cisco IOS:
```
R1# ping 172.16.99.99
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.99.99, timeout is 2 seconds:
UUUUU
Success rate is 0 percent (0/5)
```

5. Legitimate Sources & Standards References

IETF RFC 792: Internet Control Message Protocol — DARPA Internet Program Protocol Specification (J. Postel, September 1981).
IETF RFC 1812: Requirements for IP Version 4 Routers (Section 4.2.2.9: Time to Live; Section 4.3: ICMP Error Generation).
Cisco TechNotes: Using the Extended Ping and Extended Traceroute Commands (Cisco Systems documentation on !, ., and U characters).
Cisco CCNA 200-301 Exam Topics (v1.1): Domain 1.0 & 3.0 (Verify IP parameters and connectivity using ping and traceroute).

6. CCNA 200-301 Exam Prep: Questions & Detailed Answers

Question 1

When running ping 10.50.1.10 from a Cisco IOS router CLI, the output displays UUUUU (Success rate is 0 percent (0/5)). What does the U character indicate?

A. The destination host is up and replied to all 5 probes.
B. Each probe timed out waiting for an ARP Reply.
C. A router along the path (or the local router) had no route to the destination network and declared the destination unreachable.
D. The link is experiencing high UDP packet loss.

Correct Answer: C
Explanation: In Cisco IOS ping output, ! indicates a successful Echo Reply, . indicates a network timeout, and U indicates Destination Unreachable—either an upstream router returned an ICMP Type 3 (Destination Unreachable) packet, or the local router has no valid route / active egress interface to reach 10.50.1.10.

Question 2

How does the tracert (or traceroute) utility discover the IPv4 address of the second router (Hop 2) along a multi-router path?

A. It sends a broadcast ARP Request with a hop count of 2.
B. It sends a probe packet with the IPv4 TTL field set to 2, causing the first router to decrement TTL to 1 and the second router to decrement TTL to 0 and reply with an ICMP Time Exceeded (Type 11) message.
C. It queries the OSPF link-state database on each router via SNMP.
D. It reads a list of router IP addresses appended to the Ethernet FCS trailer.

Correct Answer: B
Explanation: tracert sends probes with incrementing IPv4 TTL (Time to Live) values (TTL = 1, then TTL = 2, then TTL = 3, etc.). For the TTL = 2 probe, Hop 1 decrements TTL from 2 to 1 and forwards it to Hop 2. Hop 2 sees TTL = 1, decrements it to 0, drops the packet, and sends an ICMP Time Exceeded (Type 11, Code 0) packet back to the sender using Hop 2's ingress interface IP as the Source IP.

Question 3

Which ICMP message type and code are sent by a host or router when it successfully responds to a standard ping (ICMP Echo Request, Type 8, Code 0)?

A. Type 0, Code 0 (Echo Reply)
B. Type 3, Code 0 (Destination Network Unreachable)
C. Type 8, Code 1 (Echo Acknowledgement)
D. Type 11, Code 0 (Time Exceeded)

Correct Answer: A
Explanation: Per IETF RFC 792, an ICMP Echo Request is Type 8, Code 0, and the corresponding ICMP Echo Reply is Type 0, Code 0.

Question 4

PC1 (192.168.1.10/24, Default Gateway 192.168.1.1) runs ping 172.16.10.50 and receives the output: Reply from 192.168.1.1: TTL expired in transit. What is the most likely network fault causing this message?

A. PC1's Ethernet cable is unplugged.
B. PC1 has the wrong subnet mask configured.
C. A Layer-3 routing loop exists between 192.168.1.1 (R1) and another router, causing the packet to bounce back and forth until its TTL reaches 0.
D. 172.16.10.50 has Windows Firewall enabled.

Correct Answer: C
Explanation: Standard PCs originate IPv4 packets with a high TTL (such as 128). Under normal circumstances, a packet would need to pass through 128 router hops for its TTL to expire. When TTL expired in transit occurs in a small or enterprise network, it almost always indicates a Layer-3 routing loop (for example, two routers pointing static or default routes at each other for 172.16.10.0/24), causing the packet to loop between them 128 times until TTL hits 0.

Question 5

What is the primary purpose of the 8-bit Time to Live (TTL) field in the IPv4 packet header (called Hop Limit in IPv6)?

A. To measure the round-trip latency in milliseconds of a packet.
B. To prevent packets from circulating indefinitely in the network if a Layer-3 routing loop occurs.
C. To set the maximum age of an entry in the switch's MAC address table.
D. To determine how long a DHCP lease remains valid.

Correct Answer: B
Explanation: Despite its historical name ("Time to Live"), the IPv4 TTL field is an integer hop counter (Renamed Hop Limit in IPv6 RFC 8200 for clarity). Every router that forwards the packet decrements TTL by 1. If a routing loop occurs, TTL eventually reaches 0 and the router discards the packet, preventing looped packets from consuming bandwidth forever.