ICMP Port Unreachable Packet Capture

This packet capture shows a UDP packet to a port where nothing is listening, and the router’s answer: an ICMP Destination Unreachable message with code 3, port unreachable. The UDP packet is a traceroute probe to port 33434 with a TTL of 1. Because it reached its destination, the reply is a port unreachable instead of a time exceeded. That’s how traceroute knows it has arrived.

The most useful part of any ICMP error is what it quotes: the IP header and the first bytes of the packet that caused it. The ICMP lesson covers the message types, and traceroute explains how the probes work. The ICMP Fragmentation Needed Packet Capture shows code 4 of the same message type. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packets in this capture

No.  Time      Source        Destination   Protocol  Info
1    0.000000  192.168.12.1  192.168.12.2  UDP       49153 → 33434 Len=0
2    0.000388  192.168.12.2  192.168.12.1  ICMP      Destination unreachable (Port unreachable)

Packet walkthrough

The probe (packet 1)

192.168.12.1 sends a UDP packet with source port 49153 to port 33434 on 192.168.12.2. Nothing listens on that port.

Port unreachable (packet 2)

Internet Protocol Version 4, Src: 192.168.12.2, Dst: 192.168.12.1
Internet Control Message Protocol
    Type: Destination unreachable (3)
    Code: 3 (Port unreachable)
    Checksum: 0x966a [correct]
    Unused: 00000000
    Internet Protocol Version 4, Src: 192.168.12.1, Dst: 192.168.12.2
        0100 .... = Version: 4
        .... 0101 = Header Length: 20 bytes (5)
        Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
            0000 00.. = Differentiated Services Codepoint: Default (0)
            .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
        Total Length: 28
        Identification: 0x0093 (147)
        000. .... = Flags: 0x0
            0... .... = Reserved bit: Not set
            .0.. .... = Don't fragment: Not set
            ..0. .... = More fragments: Not set
        ...0 0000 0000 0000 = Fragment Offset: 0
        Time to Live: 1
        Protocol: UDP (17)
        Header Checksum: 0x1feb [validation disabled]
        Source Address: 192.168.12.1
        Destination Address: 192.168.12.2
    User Datagram Protocol, Src Port: 49153, Dst Port: 33434
        Source Port: 49153
        Destination Port: 33434
        Length: 8
        Checksum: 0x23ee [unverified]

Let me explain what we see here:

• Type 3, code 3: destination unreachable, port unreachable. The packet reached the right host, but no application uses that UDP port. Other codes of type 3 say where delivery failed: 0 (network), 1 (host), 4 (fragmentation needed), 13 (administratively prohibited).
• Sent by the destination itself: only the host that owns 192.168.12.2 can know that the port is closed. A router along the way sends other codes.
• The quoted IP header: the ICMP message carries a copy of the original IP header, so the sender can match the error to a packet it sent. Notice TTL 1: the probe was sent with a TTL of 1, the first hop of a traceroute.
• The quoted UDP header: the first 8 bytes of the original payload, which is the whole UDP header. Source port 49153 and destination port 33434 tell the sending application exactly which probe failed.
• Total length 56: 20 bytes of IP header, 8 bytes of ICMP header, 20 bytes of quoted IP header and 8 bytes of quoted UDP header.