An ICMP Redirect is a network message that tells a host to use a different gateway for a destination. In TCP/IP routing, routers send this control message to improve path selection, but unmanaged redirects can enable traffic rerouting, reconnaissance, or man-in-the-middle abuse if hosts accept them without validation.
What ICMP Redirect Does in IP Routing
ICMP Redirect is a routing control message that tells a host to send traffic for a destination through a different next hop. In normal TCP/IP operation, it can improve path efficiency when a host picked a suboptimal gateway, but it also changes where traffic flows and therefore changes trust.
The message is part of the network control plane, not the application layer. That matters because a host that accepts redirects without validation is no longer relying only on its configured gateway or routing table, it is also accepting outside direction about where to send packets.
Why ICMP Redirect Can Be Dangerous
The security issue is not the redirect itself, but the trust it asks a host to place in a network message. If an attacker can inject or influence redirects, traffic may be steered through a malicious system, observed, modified, or dropped. That turns a routing convenience into a traffic interception primitive.
Redirect abuse can also support reconnaissance. By studying which hosts accept redirects and how they react, an attacker can learn about routing behavior, network topology, and host hardening. In environments with weak segmentation, that knowledge can help an attacker shape later movement or interception attempts.
How Organisations Validate Exposure
Exposure depends on where redirects are still permitted, which hosts listen to them, and whether upstream devices can forge or relay them. Network teams should confirm operating-system defaults, router behavior, and any local firewall or host policy that affects acceptance of ICMP control messages.
It is also important to compare intended routing design with actual traffic paths. If a subnet, jump host, appliance, or legacy segment still relies on redirects for convenience, that choice should be explicit and documented. The practical question is whether the environment gains real routing value from redirects or only inherits added attack surface.
Controls and Monitoring for Redirect Abuse
Where redirects are unnecessary, the safest pattern is to disable acceptance on hosts and prevent them from being used as a routing shortcut. If a specific platform still needs them, restrict that behavior to tightly controlled network segments and verify it against your hardening baseline, such as CIS Benchmarks.
Detection should focus on unexpected ICMP Redirect traffic, sudden next-hop changes, and destination flows that no longer match the normal gateway path. In broader control programs, NIST SP 800-53 Rev 5 Security and Privacy Controls supports the idea of protecting system integrity, logging, and configuration consistency for the network stack.
Risk and Threat Considerations
ICMP Redirect becomes risky when hosts trust network control messages more than the intended routing policy. The main concern is traffic redirection to an attacker-controlled next hop, which can create interception, downgrade, or denial of service conditions without obvious application-layer symptoms.
Failure mechanism: A forged or abused redirect changes a host’s next-hop decision, so packets follow a path chosen by the attacker instead of the configured gateway or trusted router.
Impact: The attacker may observe, alter, or block traffic, and the organisation may lose confidence in routing integrity and network segmentation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Hardening and network-path trust decisions depend on secure configuration baselines. |
| Recommendation — Apply secure configuration baselines to disable unnecessary ICMP Redirect acceptance on hosts. | ||
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Redirect abuse threatens system and path integrity by altering trusted packet routing. |
| CM-6 — Configuration Settings | ICMP Redirect handling is a configuration choice that directly affects exposure and trust. | |
| Recommendation — Monitor for unexpected routing changes and validate system integrity signals tied to network control behavior. Set and enforce host and network configuration settings that reject unnecessary ICMP Redirects. | ||
Practitioner Guidance
Why practitioners should care: ICMP Redirect is one of those legacy features that can remain harmless for years and then become a quiet control-plane weakness. Treat it as a policy decision, not a default convenience, especially on servers, sensitive subnets, and flat internal networks.
Common misunderstanding: Teams sometimes assume only malicious routing protocols matter. In practice, a single accepted redirect can be enough to change traffic flow in ways that complicate incident response and make packet-path assumptions unreliable.
Practitioner takeaway: If redirects are not explicitly needed, remove the trust path entirely and verify that monitoring can spot any unexpected next-hop changes quickly.