IP Layers, Raw Sockets & ICMP Ping Implementation

Explanation

Standard stream and datagram sockets abstract away protocol headers. When diagnostic tools like ping or traceroute must generate ICMP packets or when network security tools craft malformed test frames, raw sockets provide unrestricted packet creation capabilities. The socket call socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) instructs the kernel to deliver raw IP packets bearing protocol number 1 directly to the user space process, which parses the IP and ICMP headers manually.

Key points

• Requires root/superuser privileges (CAP_NET_RAW under Linux) to open.
• IP_HDRINCL option allows applications to construct and inject custom IP headers rather than relying on kernel generation.
• ICMP packet format: Type (8 for Echo Request, 0 for Echo Reply), Code (0), Checksum (16-bit one's complement sum), Identifier, Sequence Number.
• Ping utility sends ICMP Echo Requests with timestamps in the payload to calculate round-trip time (RTT).

Example

Code examples

struct icmp_hdr {
    uint8_t  type; // 8 for Echo Request
    uint8_t  code; // 0
    uint16_t checksum;
    uint16_t id;
    uint16_t seq;
};

// 16-bit Internet Checksum Algorithm
uint16_t checksum(void *b, int len) {
    uint16_t *buf = b;
    uint32_t sum = 0;
    for (sum = 0; len > 1; len -= 2) sum += *buf++;
    if (len == 1) sum += *(uint8_t *)buf;
    sum = (sum >> 16) + (sum & 0xFFFF);
    sum += (sum >> 16);
    return ~sum;
}

Exam questions

• [10 Marks] What is a raw socket? How does it differ from SOCK_STREAM and SOCK_DGRAM? Explain how ping is implemented using raw sockets.
• [5 Marks] Write the standard one's complement checksum algorithm used in ICMP, IP, and TCP packet headers.