ICMP is a network control protocol used for diagnostics and error reporting, including echo requests and replies. Attackers abuse it for reconnaissance, tunnelling and some denial-of-service patterns, so defenders should limit unnecessary ICMP, alert on unusual volumes or types, and distinguish legitimate path checks from abuse.
What ICMP Does in a Network
ICMP is part of the network control plane, not a transport for application data. It carries diagnostics and error signalling that help devices report reachability, fragmentation, and path behaviour, which is why tools such as ping and traceroute rely on it.
Because ICMP is essential to basic troubleshooting, it is often allowed selectively rather than blocked outright. The practical question is not whether ICMP exists, but which message types are needed for operations and which can be reduced without harming legitimate diagnostics.
Why ICMP Becomes a Security Concern
ICMP is attractive to attackers because it can reveal live hosts, routing behaviour, and network responsiveness without needing application credentials. That makes it useful for reconnaissance, and in some environments it can also support tunnelling or amplification patterns. The same protocol that helps operators understand a path can therefore help an adversary map one.
Defensive filtering has to be careful, because indiscriminate blocking can break legitimate path checks, PMTUD-related behaviour, or monitoring workflows. The security challenge is to reduce unnecessary exposure while preserving the network signals that operations still need.
For broader control context, the protocol fits naturally with NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where monitoring, boundary protection, and configuration discipline govern network traffic.
Common ICMP Message Types and Their Operational Meaning
ICMP is not one thing in practice. Echo request and echo reply messages support reachability testing, destination unreachable messages explain routing or service failures, and time exceeded messages help trace hops along a path. Those functions are operationally useful, which is why many environments retain at least some ICMP.
Different ICMP types carry different risk. A strict allow-or-deny stance often ignores that diagnostic usefulness, while type-specific policy can preserve troubleshooting and still reduce abuse. Understanding the message class matters more than treating all ICMP as equally safe or equally dangerous.
Network defence teams commonly align this kind of selective control with NIST Cybersecurity Framework 2.0 because the issue spans asset visibility, protective controls, and continuous monitoring.
How Defenders Limit Abuse Without Breaking Diagnostics
Practical ICMP control starts with deciding which messages must remain reachable between which networks, then narrowing exposure to those cases. That usually means keeping legitimate diagnostic traffic available on trusted paths, restricting unnecessary inbound ICMP from untrusted sources, and watching for unusual rates, types, or destinations.
Good practice also includes distinguishing legitimate path discovery from behaviour that looks like scanning, tunnelling, or volumetric misuse. Where ICMP is required for operations, the safer pattern is controlled allowance and telemetry, not blanket trust. If a network is heavily segmented, a zero-trust style approach can help constrain which paths are even allowed to exchange control traffic, and NIST SP 800-207 Zero Trust Architecture is a useful reference for that model.
For operational hardening and baseline hygiene, many teams also use CIS Benchmarks to support consistent firewall and host configuration decisions.
Risk and Threat Considerations
ICMP risk is less about the protocol existing and more about the visibility and control it creates. If too much ICMP is exposed, attackers can learn what is alive, what is filtered, and how the network responds, which improves reconnaissance and can support abuse patterns such as tunnelling or denial of service.
Failure mechanism: Overly permissive ICMP handling exposes network topology and control behaviour, while overly aggressive blocking can break legitimate diagnostics and hide operational faults.
Impact: The result can be easier attacker mapping, weaker detection of scanning or abuse, and degraded troubleshooting when operators lose the path signals they need.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | ICMP abuse is detected through network monitoring and anomaly observation. |
| Recommendation — Monitor ICMP patterns for scanning, tunnelling, and abnormal message types. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | ICMP is a network service whose misuse is found through continuous monitoring. |
| Recommendation — Track ICMP traffic baselines and alert on abnormal bursts or types. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | ICMP policy is shaped by constrained trust and explicit network access decisions. |
| Recommendation — Restrict ICMP paths to necessary flows and verify traffic before allowing it. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | ICMP handling is part of secure network device and firewall configuration. |
| Recommendation — Harden network devices and firewall rules to limit unnecessary ICMP exposure. | ||
Practitioner Guidance
Why practitioners should care: ICMP is a control protocol, so the right policy is usually selective allowance, not reflexive denial. The main decision is which message types are operationally necessary and which should be constrained by source, destination, and rate.
What to watch for: Monitor for unusual ICMP volume, unexpected message types, and repeated probes across many destinations, because those patterns often separate normal diagnostics from reconnaissance or covert use. Keep logging and alerting aligned with the specific ICMP behaviour your environment expects, rather than treating all control traffic the same.