ICMP Information Request

What ICMP Information Request Is Used For

ICMP Information Request was intended as a simple discovery mechanism: a host could be asked to reveal network information without opening a full application session. In practice, that made it more useful for reconnaissance than for legitimate administration, which is why it is now considered obsolete.

Because the message reveals details about the host or network, it can help an outsider build a clearer picture of the environment. Even a small response can confirm that a target is reachable, responsive, and willing to answer legacy control traffic.

Why It Is Dangerous To Leave It Exposed

The security problem is not that ICMP Information Request is powerful, but that it provides a low-friction signal to an attacker. It can reduce uncertainty during early-stage recon and support host profiling, especially when defenders assume older control messages are harmless because they are rarely used.

That is why defenders should treat it as unnecessary exposure rather than a convenience feature. Limiting or ignoring it helps reduce passive information leakage and removes one more probeable surface from the network perimeter.

How Organisations Check And Reduce Exposure

Exposure is usually checked by reviewing host and network inventories, then testing whether the environment answers legacy ICMP queries from internal or external sources. If a response is observed where it is not operationally required, that is a sign the control plane is unnecessarily reachable.

Filtering at routers, firewalls, and host-based packet controls is the normal defence, but the real question is whether any business process still depends on the message at all. In most environments it does not, so the safest posture is to block it by default and document any exception.

Detection, Verification, And Response

Monitoring should look for unexpected ICMP control traffic patterns, repeated probing from unknown sources, and any legacy responses that indicate the message is still enabled. Because the protocol is old, it is easy for it to be overlooked during routine hardening and patch reviews.

If a host answers, confirm whether the behaviour is intentional, then disable the response path or restrict it to trusted segments. ISO/IEC 27001:2022 Information Security Management and NIST SP 800-53 Rev 5 Security and Privacy Controls both reinforce the broader expectation that unnecessary network exposure should be controlled and monitored.

Risk and Threat Considerations

ICMP Information Request is mainly a reconnaissance risk. Any reply can give an attacker a lightweight confirmation that a system exists and is willing to answer, which can support profiling before deeper scanning or exploitation begins.

Failure mechanism: Legacy control traffic is often left enabled because it appears harmless, but that assumption creates a small yet avoidable disclosure channel that can be used for mapping and fingerprinting.

Impact: The practical impact is increased visibility for an attacker, which can make later targeting easier and can reveal more about network layout or host behaviour than defenders intended.

Practitioner Guidance

Why practitioners should care: Treat obsolete ICMP query types as part of your attack surface review, not as historical trivia. If they are not needed for a documented operational reason, they should not remain reachable from untrusted networks.

Practitioner takeaway: The safest default is to block legacy ICMP information queries and verify that no monitoring or troubleshooting process still depends on them.

Related resources from NHI Mgmt Group

• What is the difference between a DSAR and a general request for information about a customer?
• What happens when a firm cannot respond promptly and accurately to a FINRA information request?
• What should teams do when a wire transfer request includes new banking information or an urgent exception to process?
• What happens when a subject access request includes information about other individuals?