ICMP Tunneling Large Echo Request Payload Exfiltration

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects anomalous ICMP Echo Request packets (Type 8) directed towards external networks that contain a payload size greater than 128 bytes. Such anomalies are often indicative of ICMP tunneling, which may be leveraged by adversaries for command and control (C2) communication or data exfiltration.