Skip to content

ICMP tunneling

1. Context & stakes

Exfiltrate in ICMP echo payloads (companion to the DNS tunnel).

ICMP echo payloads are arbitrary and rarely inspected, so an attacker can carry a data channel inside ping traffic that many networks permit unconditionally. Like DNS tunneling it defeats port-based firewalls by hiding in an allowed protocol. Inspecting or rate-limiting echo payloads, and treating large or patterned pings as suspicious, are the countermeasures.

2. Theory

ICMP echo request/reply carry an arbitrary payload that is rarely inspected, so a client and server exchange data by stuffing it into ping packets - an exfiltration/C2 tunnel that looks like ordinary ping. Defence inspects or blocks outbound echo and flags oversized/high-rate ICMP.

3. Attack (PoC)

netlab-icmptunnel attack --i-own-this-network --iface veth-host
  1. Encode exfil in the echo payload

4. Detection

netlab-icmptunnel detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Payload inspection, block outbound echo

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading