The ICMP header is a 32-bit extension to an IP carrying protocol number 1 (0x01). Each ICMP datagram varies in structure, depending on the type of ICMP message it is. The first two bytes are the ICMP type and code, the next two are the checksum, and the following four bytes are type-specific. The payload is then a variable length field of up to 576 bytes.

The most commonly seen messages are the echo request (for ping; type 8, code 0) and echo reply (for ping; type 0, code 0), although messages such as destination unreachable (type 3, codes 0-15) perhaps include more helpful information for network analysts.