ICMP Tunneling via Oversized Echo Request High Frequency Internal to External

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects high-frequency ICMP Echo Requests (Type 8) directed from internal networks to external destinations with oversized payloads (greater than 200 bytes). This pattern is indicative of ICMP tunneling, which is often used by adversaries for covert command-and-control (C2) communications or data exfiltration, bypassing standard filtering or monitoring.