ICMP Destination Host Unknown (Type 3, Code 7)

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Check ARP resolution
ping -c 1 host_ip
arp -a | grep host_ip
# Update ARP table manually
sudo arp -s host_ip mac_address
# Check DHCP assignments
sudo tail /var/log/dhcp/dhcpd.log

How to diagnose ICMP errors

ICMP is the diagnostic layer of IP, and its messages are the network telling you precisely why a packet could not be delivered. Learning the type/code pairs turns vague "the network is broken" reports into specific diagnoses: Type 3 Code 1 means a router reached the destination network but not the host; Type 3 Code 4 (fragmentation needed) is the signature of a broken Path MTU Discovery, which causes the classic "small requests work, large requests hang" symptom. Blanket-blocking ICMP at a firewall breaks PMTUD and is a common self-inflicted outage.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Capture the ICMP itself: sudo tcpdump -n icmp. The type and code are printed in plain text and give you the exact reason.
2. Use traceroute (or mtr for a continuous view) to see which hop generates the unreachable or time-exceeded message.
3. Suspect PMTUD when small packets succeed and large transfers stall. Test with ping -M do -s 1472 host and lower the size until it passes to find the real MTU.
4. Never block ICMP Type 3 Code 4 or Type 11 at a firewall. They are required for correct TCP operation and for traceroute.
5. For IPv6, remember ICMPv6 is mandatory. Neighbour Discovery and PMTUD both depend on it, so filtering it breaks connectivity entirely.

Tools worth reaching for

• tcpdump -n icmp
• traceroute / mtr
• ping -M do -s
• tracepath
• nmap --traceroute

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 tools.ietf.org

Related ICMP errors

• ICMP Communication Administratively Prohibited (Type 3, Code 13)Communication between source and destination is blocked by administrative policy or firewall.
• ICMP Destination Network Unknown (Type 3, Code 6)Router has no information about the destination network. Different from network unreachable -…
• ICMP Destination Unreachable (Type 3)Router cannot forward packet to destination. Various codes indicate specific reasons like…
• ICMP Echo Request/Reply (Type 8/0)Ping mechanism. Echo Request (8) sent by client, Echo Reply (0) returned by destination. Used…
• ICMP Fragmentation Needed (Type 3, Code 4)Packet too large for next hop link, but Don't Fragment bit is set. Critical for Path MTU…
• ICMP Host Administratively Prohibited (Type 3, Code 10)Host access is specifically blocked by administrative policy or security rules.
• ICMP Host Precedence Violation (Type 3, Code 14)Packet precedence level is not permitted for the destination host. Security or QoS policy…
• ICMP Host Unreachable (Type 3, Code 1)Router cannot reach the specific host within the destination network. Host may be down…

See all 23 ICMP errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.