ICMP: Functions and threats

Visit us at it-sa 2024!

ICMP

What Is the Internet Control Message Protocol (ICMP)?

The Internet Control Message Protocol (ICMP) is a central component of the protocol family on the World Wide Web. ICMP is mainly used to transmit error messages and diagnostic information in networks and data centers. In contrast to transport protocols such as TCP or UDP, information about the status of network connections and devices is to be transmitted. Cyber criminals misuse the protocol for DDoS attacks (Distributed Denial of Service).

Combating ICMP risks with Myra

ICMP: A Definition

The Internet Control Message Protocol is used by network devices such as routers to report errors that may occur during the transmission of IP packets. For example, an ICMP message can be sent if a router is unable to deliver a packet because the destination cannot be reached or there is a timeout. ICMP messages are encapsulated in IP packets and contain type and code fields to identify the type of error or information.

The most commonly used ICMP-based tools include the diagnostic tools Ping and Traceroute.

Ping & Traceroute

Ping is one of the best-known diagnostic tools based on ICMP. It sends ICMP echo requests to a target device (host) and waits for echo responses. This makes it possible to test the reachability of a device in the network and to measure the round trip time (RTT), i.e. the time it takes for a packet to reach its destination and return. Ping is a simple but effective diagnostic tool for checking the network connection and latency and is usually executed as a console command.

Traceroute is another ICMP-based diagnostic tool. Traceroute can be used to determine the exact path that data packets take through a network to reach their destination. It sends ICMP packets with incrementally increased time-to-live (TTL) values. Each router on the path decreases the TTL value by one and responds with a “Time Exceeded” ICMP message when the TTL value reaches zero. These responses allow Traceroute to map the route and measure the time it takes for each packet to reach each hop. Traceroute provides detailed information about all intermediate stations (hops) between source and destination and thus helps to identify bottlenecks or faulty connections in the network.

Convince yourself of our customized Security-as-a-Service solutions for IT infrastructures and web applications.

Request a free demo now

What ICMP Packet Types Are There?

ICMP uses various packet types to report network errors and perform diagnostics. The ICMP packet types are assigned by the Internet Assigned Numbers Authority (IANA). The most important ICMP packet types include:

Type 0: Echo Reply - Reply to an echo request to check the reachability of a host
Type 3: Destination Unreachable - Informs the sender that a destination address is unreachable. Various codes indicate specific reasons, e.g. network or host unreachable.
Type 4: Source Quench (deprecated) - Used to ask the sender to reduce the speed of the packet transmission.
Type 5: Redirect - Instructs a host to use a better route to a destination via another router.
Type 8: Echo Request - Used in the ping command to test the reachability of a host.
Type 9: Router Advertisement - Routers regularly send information about themselves to hosts in the network.

Type 10: Router Selection - Hosts send requests to cause routers to immediately send Router Advertisement messages.
Type 11: Time Exceeded - Indicates that the time to live (TTL) of a packet has expired before it could reach its destination.
Type 12: Parameter Problem - Reports problems with the header of a received packet.
Type 13: Timestamp - Allows a host to request the time from another host (timestamp message).
Type 14: Timestamp Reply - Reply to a timestamp request with time information according to type 13.

What Are the Dangers of ICMP?

Cyber criminals misuse the properties of ICMP to provoke network infrastructure overload. In addition to the ICMP flood, the most common types of attack include the smurf attack and the ping of death. ICMP, which was primarily created for network diagnostics, has various vulnerabilities that can be exploited by attackers. One of the biggest security deficits is the lack of authentication of ICMP messages, which enables attackers to send forged packets.

ICMP Flood
An ICMP flood, also known as a ping flood, is a type of DDoS attack in which a large number of ICMP echo requests are sent to a target system. The goal is to overload the target's network resources and block legitimate traffic. To achieve this, the attacker sends a flood of echo request packets to the target system, to which the attacked system responds with echo reply packets. The bandwidth generated in this way leads to an overload of outgoing network traffic as soon as the attack bandwidth on the cybercriminal's side exceeds the victim's capacities. The ping flood attack can be classified as a DoS attack if it originates from a single computer or as a DDoS attack if it is carried out by a botnet.
Ping of Death
The Ping of Death is a historical network attack that belongs to the Denial of Service (DoS) attacks. It uses ICMP to send a malicious data packet to a target system that exceeds the permitted packet size when it is assembled, causing a memory buffer overflow. This leads to crashes or system freezes on unprotected systems.

Originally this attack caused immediate crashes on vulnerable systems, but since around 1998 most systems have been protected against it. Modern systems have implemented security measures to prevent such attacks, e.g. checking the maximum packet size and filtering malicious packets through routers and firewalls. As a result, the ping of death is hardly a threat today, while hackers are more likely to use other attacks such as ping floods.
Smurf Attack
The Smurf Attack is a form of DDoS that aims to paralyze a computer system or network by flooding it with ICMP packets. Attackers exploit vulnerabilities in the IP and ICMP protocols by sending packets with a forged sender IP to a broadcast address. These packets reach all devices in the network, which then react with ICMP responses to the supposed victim, which can overload its system. The name “Smurf” comes from a program published in 1997 called “smurf.c” and symbolizes the idea of many small attackers that can overwhelm a larger adversary.

Thanks to the implementation of countermeasures and adapted configurations in network technology, smurf attacks, like the ping of death, are no longer common today. However, in legacy environments or improperly configured networks, a smurf attack can still cause great damage.
ICMP Flood
An ICMP flood, also known as a ping flood, is a type of DDoS attack in which a large number of ICMP echo requests are sent to a target system. The goal is to overload the target's network resources and block legitimate traffic. To achieve this, the attacker sends a flood of echo request packets to the target system, to which the attacked system responds with echo reply packets. The bandwidth generated in this way leads to an overload of outgoing network traffic as soon as the attack bandwidth on the cybercriminal's side exceeds the victim's capacities. The ping flood attack can be classified as a DoS attack if it originates from a single computer or as a DDoS attack if it is carried out by a botnet.
Ping of Death
The Ping of Death is a historical network attack that belongs to the Denial of Service (DoS) attacks. It uses ICMP to send a malicious data packet to a target system that exceeds the permitted packet size when it is assembled, causing a memory buffer overflow. This leads to crashes or system freezes on unprotected systems.

Originally this attack caused immediate crashes on vulnerable systems, but since around 1998 most systems have been protected against it. Modern systems have implemented security measures to prevent such attacks, e.g. checking the maximum packet size and filtering malicious packets through routers and firewalls. As a result, the ping of death is hardly a threat today, while hackers are more likely to use other attacks such as ping floods.

The Security-as-a-Service solutions from Myra provide reliable protection for your infrastructure against ICMP-based threats and other risks. Ensure the security of your critical business processes proactively, sustainably and in compliance.

What Protective Measures Help Against ICMP Attacks?

To protect themselves against ICMP attacks, organizations should take the following measures:

Monitoring network traffic

Unusually high volumes of ICMP traffic may indicate an ongoing attack.

Rate Limiting

Using rate limiting, network administrators have the option of blocking harmful traffic via ICMP packets.

Firewall rules

By using and properly configuring firewall instances, ICMP traffic from unknown or malicious sources can be blocked.

DDoS protection solutions

Dedicated DDoS protection solutions defend networks and infrastructures effectively and in real time against ICMP flood attacks and other threats from malicious traffic flows.

ICMP: What You Need to Know

ICMP plays a critical role in the network infrastructure both for legitimate purposes such as diagnostics and as an attack vector for security threats. A robust configuration of network infrastructure is therefore essential to prevent ICMP-based threats.

Dedicated DDoS protection solutions such as Myra Cloud Scrubbing efficiently protect against ICMP attacks and other cyber threats at the network and transport layer (Layer 3/4).

Would you like to learn more about our solutions, application examples and best practices for attack defense? In our download area you will find product sheets, fact sheets, white papers and case studies.

Go to downloads

Responsible Disclosure Legal notice Privacy policy Privacy Settings Terms and Conditions