Detect it by reviewing ICMP error traffic for repeated messages that quote portions of an original packet in a way that reveals parsing behaviour. Attackers use this to fingerprint stacks and middleboxes, so defenders should inspect packet captures and look for unusual ICMP errors generated during systematic probing of a host or network path.
How defenders spot ICMP quoting behavior in packet data
Start with packet captures or flow telemetry that preserve ICMP payload detail. A quoting probe is usually visible as a series of ICMP error messages that consistently include small excerpts of the same original packet, often with enough repetition to show the probe is testing how a host, firewall, or router parses headers and embedded data.
Look for patterns rather than a single event. The useful signal is repeated ICMP errors tied to the same source, destination, or test range, especially when the quoted bytes change in a controlled way across attempts. That pattern suggests deliberate fingerprinting, not ordinary path noise.
On a live network, the strongest indicator is an unusual concentration of ICMP errors generated during systematic probing of one target or one path segment. If the quoted payloads consistently expose header structure, extension handling, or filtering behavior, the probe is probably being used to learn how the stack responds under edge conditions.
What makes ICMP error quoting a reconnaissance technique
ICMP errors are supposed to return limited information about the packet that triggered them, but that limited quotation can still reveal parsing behavior. By varying the probe and comparing the returned quote, an attacker can infer whether a device trims, rewrites, fragments, or mishandles specific fields.
That makes the technique valuable for reconnaissance because it can expose differences between operating systems, middleboxes, and security controls without requiring a full exploit. The activity is low-noise compared with active intrusion, yet it can still map network behavior, detect inconsistent filtering, and identify where further probing is most likely to succeed.
Detection therefore depends on correlation. One ICMP error is rarely meaningful on its own, but repeated error quotations that align with a structured probing sequence are worth investigation. If the same pattern appears across multiple destinations, treat it as a scanning campaign or a preparatory step in a broader attack chain.
What to check before calling it malicious
Verify whether the quoted portion matches legitimate diagnostics first. Some network tools and path tests naturally generate ICMP errors, so the key question is whether the traffic is routine troubleshooting or a systematic attempt to learn about parsing behavior. Repeated variation across payload fields is what most often distinguishes probing from normal operations.
Also check whether intermediate devices are amplifying the signal. A misconfigured firewall, router, or load balancer can generate misleading ICMP errors that resemble probing, which is why you need to compare the quoted packet with the original capture and confirm the source of the error generation.
If the pattern is suspicious, preserve the packet evidence and the timing relationship between the probe and the response. That context helps distinguish a deliberate quoting test from benign ICMP noise and gives analysts enough detail to decide whether the behavior is part of reconnaissance, policy testing, or a control misconfiguration.
Risk and Threat Considerations
ICMP quoting probes can expose how a target parses packets, which turns a seemingly small error message into a reconnaissance channel. The risk is not the ICMP reply itself, but the fact that it can reveal stack behavior, filtering gaps, and middlebox differences that help an attacker choose the next probe.
Failure mechanism: Repeatedly elicited ICMP errors return quoted packet fragments that differ in predictable ways, allowing an observer to fingerprint parsing logic, fragmentation handling, or policy enforcement.
Impact: The probe can support host and network fingerprinting, identify weak inspection points, and increase the efficiency of later exploitation or evasion attempts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1016 — System Network Configuration Discovery | ICMP probing reveals network and stack behavior used for discovery. |
| Recommendation — Correlate repeated ICMP quote patterns with discovery activity and investigate the probing source. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | Detecting ICMP probe patterns depends on network monitoring and alerting. |
| Recommendation — Monitor ICMP error patterns and alert on repeated quoting behavior from the same source or path. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Network monitoring is the core control for spotting probe patterns in ICMP traffic. |
| Recommendation — Inspect packet captures and network telemetry for repeated ICMP quoting sequences. | ||
Practitioner Guidance
What to verify: Confirm that the ICMP errors are tied to a deliberate sequence of probes, not to legitimate troubleshooting or routing instability. The deciding evidence is repetition with controlled variation in the quoted bytes, not the presence of ICMP errors alone.
What to measure: Track the rate of ICMP errors per source, destination, and time window, then compare the quoted payload patterns across events. A small number of unrelated errors is normal; a concentrated burst with systematic differences is the signal to escalate.
Practitioner takeaway: Treat quoted ICMP content as reconnaissance data when it appears in a repeatable pattern, because the security question is not whether ICMP is allowed, but whether the quoted bytes are exposing parsing behavior that helps an attacker map your environment.