Network Intrusion Detection, Third Edition

Chapter 4. ICMP

Internet Control Message Protocol (ICMP) was conceived as an innocuous method of reporting error conditions and issuing and responding to simple requests. Perhaps because of its seemingly benign origins, some of the current mutations of ICMP for less-than-upstanding purposes seem all the more outrageous. In its pure state, ICMP is supposed to be a relatively simple and chaste protocol, but it has been altered to act as a conduit for evil purposes. Therefore, it is important to understand how this protocol is used both for its intended purposes and for malicious purposes.

This chapter examines several aspects of ICMP. First, you are ...