ICMP Tunneling - Large Echo Request Payload Over 1000 Bytes

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects ICMP Type 8 (Echo Request) packets with a payload size exceeding 1000 bytes. This is a common indicator of ICMP tunneling, where attackers encapsulate data within ICMP packets to bypass network security controls for command and control or data exfiltration.