All of us know that ICMP used by administrators to check connectivity between devices even attackers use this to make ping sweeping to know what devices is on and what is off, but did you hear before that attackers can use ICMP for “Data Exfiltration”? Yep, it's used…

So, how it's done, how we can detect it, and more…

Okay, First these are the topics, we will talk about:

• What is ICMP and what used for?
• How does ICMP Work?
• ICMP Packet Header
• How ICMP works inside TCP/IP?
• ICMP Data Exfiltration
• Detection & Prevention
• Why this technique is dangerous?

📌 What is ICMP and what used for?

• ICMP (Internet Control Message Protocol) is a network layer protocol used for diagnostics, error reporting**,** and connectivity testing in IP networks. Unlike TCP or UDP, ICMP is not used for data transfer, but rather to communicate network-related issues between devices.
• It’s a layer 3 protocol that we use to check the connectivity between 2 devices and it does not have a port number. We can use it with the ping & traceroute commands.
• The purpose of ping is to determine if the system at a certain IP address exists and is currently functional, and that a route to that system can be found.

📌 How does ICMP work?

• It's a connectionless protocol as we said so, it doesn't establish a session with the destination as TCP but it's simple as shown in this image:

  1. The client send an echo request
  2. The server replies with an echo reply

  <aside> 👉🏻

  It's one request and one response.

  </aside>