ICMP Tunneling Covert Channel - icmpsh or ptunnel Large Echo Request

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects anomalous ICMP traffic patterns, specifically ICMP Echo Request packets with unusually large payload sizes (dsize > 64) and specific byte signatures consistent with known ICMP tunneling tools such as icmpsh or ptunnel, which are used to establish covert C2 channels.