The Echo Pair

Reply Type and Code

The echo reply has the same layout, but a different type byte and checksum.

highlighted = computed this step

The reply changes the type

The echo reply has the same shape as the request, but the type byte changes. Code stays zero.

reply type=0,code=0\text{reply type}=0,\quad \text{code}=0
Reply type and codeThe request and reply fields are decoded from exact ICMP bytes.Echo request64 bits / 8 bytes0x0800e5ca12340001byte 0byte 1byte 2byte 300001000000000001110010111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type8code0checksum0xe5caidentifier0x1234sequence1Echo reply64 bits / 8 bytes0x0000edca12340001byte 0byte 1byte 2byte 300000000000000001110110111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type0code0checksum0xedcaidentifier0x1234sequence1

Reply type

The reply type is 0. The code byte is still 0.

type=0,code=0\text{type}=0,\quad \text{code}=0
Reply type and codeThe request and reply fields are decoded from exact ICMP bytes.Echo request64 bits / 8 bytes0x0800e5ca12340001byte 0byte 1byte 2byte 300001000000000001110010111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type8code0checksum0xe5caidentifier0x1234sequence1Echo reply64 bits / 8 bytes0x0000edca12340001byte 0byte 1byte 2byte 300000000000000001110110111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type0code0checksum0xedcaidentifier0x1234sequence1

The checksum changes too

Because the type byte changed, the reply checksum is 0xedca instead of the request checksum.

reply checksum=0xedca\text{reply checksum}=0xedca
Reply type and codeThe request and reply fields are decoded from exact ICMP bytes.Echo request64 bits / 8 bytes0x0800e5ca12340001byte 0byte 1byte 2byte 300001000000000001110010111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type8code0checksum0xe5caidentifier0x1234sequence1Echo reply64 bits / 8 bytes0x0000edca12340001byte 0byte 1byte 2byte 300000000000000001110110111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type0code0checksum0xedcaidentifier0x1234sequence1

Summary

Request and reply are distinguished by type byte here. The checksum changes because it covers the whole ICMP echo message.

reply type=0\text{reply type}=0
Reply type and codeThe request and reply fields are decoded from exact ICMP bytes.Echo request64 bits / 8 bytes0x0800e5ca12340001byte 0byte 1byte 2byte 300001000000000001110010111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type8code0checksum0xe5caidentifier0x1234sequence1Echo reply64 bits / 8 bytes0x0000edca12340001byte 0byte 1byte 2byte 300000000000000001110110111001010byte 4byte 5byte 6byte 700010010001101000000000000000001type0code0checksum0xedcaidentifier0x1234sequence1