ICMP (Internet Control Message Protocol)

Hello Hussein!

ICMP is a Layer 3 protocol. It actually never reaches Layer 4. So Wireshark doesn’t display any Layer 4 encapsulation because there is none.

The encapsulation process starts at Layer 3, where source and destination IP addresses are assigned as usual, and gets encapsulated to layer 2 (where Ethernet, MAC addresses and PPP live to name a few) and then it is placed on the medium. Deencapsuation occurs at the destination up to layer three where the source and destination IP addresses are read. The ICMP protocol adds a header AFTER the IP header with additional information necessary for the protocol to function (echo request, echo reply etc). Once deencapsulation occurs at layer 3 there are no more layers to deencapsulate. The ICMP packet has done its job.

Notice that Wireshark, after the IP header, displays the ICMP header and its contents. It is important to note that this is not a Layer 4 header that is displayed, but it is an additional header on layer 3.

I hope this helps!

Laz

2 Likes