What attacks target Internet Control Message Protocol (ICMP)?

What kinds of attacks use ICMP as the target or transport?

ICMP is attractive because it is widely allowed, easy to generate, and useful for both discovery and disruption. Attackers can use it to probe reachability, create noisy reconnaissance, and carry traffic in ways that bypass simple filtering. The key distinction is between ICMP as a reconnaissance signal and ICMP as a transport path for covert or abusive traffic.

At the low end, ICMP echo requests can be used for host discovery and ping sweeps across subnets. At the disruptive end, attackers use ICMP floods and reflection or amplification patterns, including smurf-style abuse, to consume bandwidth or overload devices. Some environments also see ICMP tunnelling, where data is embedded in echo traffic to evade normal inspection.

Because ICMP serves multiple protocol functions, the same traffic type can reveal topology, validate live hosts, or support denial of service. That is why defenders should treat ICMP as a controlled protocol, not a protocol to either trust by default or block indiscriminately.

Why attackers use ICMP for recon, smurf-style abuse, and tunnelling

ICMP helps attackers learn quickly with minimal effort. A sweep can show which addresses respond, which gateways are alive, and where filtering differs across segments. That makes ICMP a useful first pass before more targeted exploitation, especially when attackers want a low-noise way to map the environment.

It also works as an abuse channel when availability is the goal. Floods can consume host CPU, network capacity, or state in firewalls and security appliances. Reflection and amplification are more damaging when spoofing is possible and broadcast or misconfigured intermediary behaviour exists. The same protocol can therefore support both early-stage reconnaissance and later-stage service disruption.

ICMP tunnelling is valuable to attackers because it can blend into traffic that many organisations allow for troubleshooting. Where inspection is weak, echo payloads may carry commands or exfiltrated data inside an otherwise ordinary protocol exchange. For that reason, detection depends more on patterns, volume, and payload behaviour than on protocol name alone.

For protocol context and registry reference, the IANA registries are the right place to confirm identifiers and related protocol parameters.

Where ICMP is being used as part of a broader attack chain, the behaviour often overlaps with beaconing, tunnelling, or command-and-control tradecraft described in the Command and Control (C2) Guide.

What should defenders watch for and control first?

The practical question is not whether ICMP exists, but which ICMP types, rates, and directions are actually required. Many networks need echo replies, path discovery, or PMTU-related behaviour, but do not need unrestricted inbound echo from everywhere. Filtering should be selective so that legitimate diagnostics remain possible while obvious abuse is reduced.

Monitoring matters as much as filtering. Sudden spikes in echo requests, repeated sweeps across many addresses, unusual ICMP types, or ICMP traffic from unexpected segments are stronger signals than a blanket “ICMP allowed” or “ICMP blocked” policy. In practice, the best defensive posture is usually rate limiting, type filtering, and detection tuned to baseline behaviour.

When tunnelling is a concern, look for long-lived or repetitive echo sessions, unusual payload sizes, and outbound ICMP that does not match normal troubleshooting behaviour. The most useful response is often to correlate ICMP patterns with other indicators, such as concurrent scanning, unusual egress destinations, or host-side anomalies.

If you need protocol-level background, the IETF is the standards venue that defines how internet protocols are specified and maintained.

For network teams, the Network Ports and Protocols Security Guide is useful because ICMP decisions should be made alongside the rest of the exposed protocol surface, not in isolation.

What a defender should do when ICMP traffic looks malicious

Start by classifying the traffic: legitimate diagnostics, discovery activity, or disruption. That classification drives the response. A small burst of echo requests may be benign troubleshooting, while broad sweeps or sustained floods suggest active probing or a denial-of-service attempt.

If you suspect tunnelling, preserve packet captures and compare payload structure, timing, and destination patterns against normal operations. If the traffic is flooding or reflection-based, rate limiting and edge filtering may be the fastest containment steps. Where the environment is sensitive, coordinate firewall, router, and host controls so that one layer does not simply shift the problem to another.

Practitioner takeaway: ICMP is best treated as a protocol with legitimate operational use and a known abuse surface, so defenders should tune controls to the specific ICMP types and traffic patterns they actually need, then detect the deviations that indicate recon, tunnelling, or flood behavior.

Related resources from NHI Mgmt Group

• How does Internet Control Message Protocol (ICMP) work?
• Internet Control Message Protocol (ICMP)
• How can organizations counter AI-driven cyber attacks?
• How should security teams reduce exposure of industrial control systems to internet-facing attacks?