ICMP Tunneling - Outbound Echo Request with Large Payload

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects outbound ICMP Type 8 (Echo Request) packets that contain an abnormally large payload (greater than 64 bytes). This behavior is characteristic of ICMP tunneling, where attackers encapsulate data within the payload of ICMP packets to bypass network security controls or establish covert command and control communication.