How do attackers use ICMP?

How ICMP supports discovery, reconnaissance, and signalling

ICMP is not just a diagnostics protocol. In attacker hands, it becomes a lightweight way to learn which hosts respond, infer network reachability, and map paths through filtering or segmentation. Because ICMP sits below the application layer, it can reveal useful topology and connectivity information before noisier activity begins.

The most common abuse is reconnaissance. Echo requests, unreachable messages, time-exceeded responses, and related ICMP behaviours can help an attacker test what is alive, what is blocked, and where packet handling changes along the route. That makes ICMP useful both for pre-attack planning and for validating whether a later exploit path is worth pursuing.

ICMP can also be used as a signalling channel. Low-volume, patterned, or unusual payload activity can carry covert instructions or acknowledgements in environments where ordinary outbound controls are monitored more loosely than TCP or UDP application traffic. The protocol is simple, but the misuse often depends on repetition, timing, and shape rather than obvious payload size.

How attackers abuse ICMP for disruption or staging

Once discovery is done, ICMP may support the next phase of attack work. Adversaries use it to confirm that a target is reachable before launching scanning, credential attacks, or lateral movement, and they may blend ICMP into staging activity to avoid drawing attention early. The value is not stealth in the classic sense, but low-friction confirmation with minimal protocol overhead.

ICMP can also be part of flooding or other bandwidth-abuse patterns. Even when the protocol is not the main delivery path for an intrusion, excessive echo traffic, malformed requests, or bursty patterns can consume capacity, trigger alarms, or obscure other malicious activity. In operations terms, ICMP is often a support channel for campaign sequencing, not the whole campaign itself.

That is why defenders should treat ICMP as part of the network's control surface, not as harmless background noise. A broad allow-by-default posture can leave useful visibility gaps, while an over-restrictive posture can break legitimate diagnostics and obscure troubleshooting. The practical question is which ICMP types are genuinely needed and whether the permitted traffic matches expected business use.

What defenders should watch and how to respond

Detection works best when ICMP is judged by pattern, not by a single packet. Unusual destination breadth, repeated probes to many hosts, spikes in echo requests, or ICMP events that line up with later scanning, authentication failures, or east-west movement are stronger signals than isolated pings. Correlation matters because attackers often use ICMP as a precursor, not the final exploit path.

When the traffic looks abnormal, defenders should verify whether the source is a known monitoring tool, a load balancer check, or an approved troubleshooting workflow before assuming malicious use. If the source is unknown or the traffic pattern is inconsistent with normal operations, the right response is to narrow exposure, preserve logs, and check whether the activity precedes other reconnaissance or internal movement.

For environments with strict segmentation, ICMP can expose policy mistakes as much as attacker activity. If hosts that should not be reachable still answer ICMP, that can reveal shadow routes, permissive firewall rules, or misconfigured network controls. In that sense, ICMP monitoring is both threat detection and control validation.

Risk and Threat Considerations

ICMP is attractive to attackers because it is widely present, operationally useful, and often under-monitored compared with application traffic. The risk is not just flooding; it is that a small amount of ICMP can expose reachability, confirm internal structure, and support later stages of an intrusion without triggering the same scrutiny as direct exploit traffic.

Failure mechanism: Attackers exploit permissive ICMP handling, weak filtering, or poor correlation to turn simple diagnostic traffic into a reconnaissance and signalling channel, then use the results to guide follow-on abuse.

Impact: Defenders may miss early-stage discovery, misread benign probes as harmless, or fail to connect ICMP patterns with broader scanning, staging, or lateral movement, which increases the chance of a successful intrusion.

Practitioner Guidance

What to verify: Confirm which ICMP types are actually required by the environment, then test whether current firewall and host rules allow only those forms. If the network does not need a type for operations or troubleshooting, do not leave it open by default.

What to measure: Track baseline ICMP volume, source diversity, and destination spread. The most useful signal is not total count alone, but deviation from normal, especially when ICMP activity precedes port scanning, authentication anomalies, or internal discovery.

Decision rule: If ICMP is coming from an untrusted segment, is unusually bursty, or lacks a clear operational owner, treat it as suspicious until correlated with an approved monitoring or diagnostic workflow.

Practitioner takeaway: ICMP should be governed as an observable control channel, not an exception to network security, because attackers often use it first to learn the environment and only later to attack it.

Related resources from NHI Mgmt Group

• Guide: Network Ports and Protocols Security Guide
• How do attackers use list planting?
• How do attackers use invisible Unicode?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?