ICMP Tunneling

What is ICMP Tunneling?

ICMP tunneling encapsulates data within ICMP echo request and response packets (ping). The technique exploits the fact that ping is often permitted through firewalls—legacy security policy assumed no harm could come from echo requests. While modern firewalls are more restrictive, ICMP tunneling remains a technique used in penetration testing and by malware to bypass network restrictions.

The Internet Control Message Protocol (ICMP, RFC 792) is designed for network diagnostics and error reporting. Echo requests (Type 8, Code 0) and echo replies (Type 0, Code 0) are used by the ping utility to test connectivity. The protocol includes an identifier, sequence number, and data payload—fields that can carry arbitrary data.

ICMP Packet Structure

ICMP echo packets have the following structure:

ICMP Header (8 bytes):
  Type (1 byte): 8 = Echo Request, 0 = Echo Reply
  Code (1 byte): 0 for echo
  Checksum (2 bytes): ICMP checksum
  Identifier (2 bytes): Sender's identifier (tunnel ID)
  Sequence Number (2 bytes): Packet sequence number

Data Payload (variable, up to MTU - IP header - ICMP header):
  Arbitrary tunnel data

Standard ping uses 64 bytes of data (including the ICMP header) by default. The data field can carry significantly more—the limiting factor is the path MTU, typically 1400-1500 bytes for Ethernet. Tunnels commonly use larger payloads (100s of bytes to 1KB+).

ptunnel-ng

The primary tool is ptunnel-ng (Ping Tunnel Next Generation), a fork of the original ptunnel. It creates TCP connections over ICMP by encapsulating TCP handshake and data packets within ICMP echo payloads.

How ptunnel-ng Works

1. Handshake: Client sends an ICMP echo request with tunnel login data to the ptunnel-ng proxy
2. Authentication: Proxy verifies credentials (password-based)
3. Tunnel establishment: Client and proxy establish ICMP state table entries
4. TCP encapsulation: Outgoing TCP packets are serialized, length-prefixed, and embedded in ICMP data payloads
5. Proxy forwarding: Proxy decapsulates TCP data and forwards to actual destination
6. Response: Destination responses are encapsulated in ICMP replies back through the tunnel

Command Example

# Start ptunnel-ng proxy on Linux (requires root)
ptunnel-ng -p <password>

# Connect through the proxy (also requires root)
ptunnel-ng -p <password> -l <local_port> <destination> <dest_port>

# Example: Tunnel SSH through ICMP
ptunnel-ng -p mypassword -l 2222 targetserver.com 22

Packet Format Details

ptunnel-ng uses a custom protocol within the ICMP data field:

ptunnel-ng Protocol (within ICMP data):
  Magic (4 bytes): 0xDEADBEEF (identification)
  Version (2 bytes): Protocol version
  Type (1 byte): 0x01=login, 0x02=TCP data, 0x03=heartbeat
  Code (1 byte): 0=start, 1=stop, 2=heartbeat response
  Connection ID (2 bytes): Links request/response pairs
  Data length (4 bytes): Length of encapsulated data
  Sequence number (4 bytes): Packet ordering
  Checksum (2 bytes): Protocol-level checksum
  Data (variable): Encapsulated TCP packet or login credentials

Detection Methods

ICMP tunneling is relatively easy to detect compared to other tunneling methods:

• Large ICMP packets: Normal ping is 64 bytes (plus IP header = 84 bytes on Ethernet). ptunnel-ng uses 100s to 1000+ bytes per packet.
• Structured data in payloads: Inspection of ping payloads reveals protocol headers, TCP segments, or non-random data patterns.
• High frequency: Tunneling requires frequent ping exchanges to maintain throughput. Normal ping typically sends 1 packet/second.
• ICMP from same source: Sustained ICMP exchange between two hosts is unusual for normal network behavior.
• Unusual destination addresses: ICMP traffic to external IPs that are not typical ping targets.
• Session duration: Normal ping sessions are brief. Tunnel sessions persist for minutes to hours.
• Identical identification fields: Tunnel clients use fixed identifier values for packet correlation.

Detection Rules Example (Snort/Suricata)

# Detect large ICMP packets (ptunnel default is larger than 64 bytes)
alert icmp any any -> any any (msg:"Large ICMP packet detected"; dsize:>100; classtype:bad-unknown; sid:1000001; rev:1;)

# Detect ICMP with data payload containing TCP-like structures
alert icmp any any -> any any (msg:"ICMP payload contains IP-like header"; content:"|45|"; depth:1; classtype:covert-traffic; sid:1000002; rev:1;)

# Detect sustained high-frequency ICMP from single source
alert icmp any any -> any any (msg:"High-frequency ICMP traffic"; threshold:type threshold, track by_src, count 100, seconds 60; classtype:denial-of-service; sid:1000003; rev:1;)

Limitations

• Root/admin privileges required: Both client and proxy must run with elevated privileges to send/receive ICMP
• Single port only: Each ptunnel-ng session handles one TCP connection at a time
• High latency: ICMP round-trip timing introduces significant latency compared to direct TCP
• Throughput limits: ICMP acknowledgment behavior limits bandwidth
• Blockable: ICMP can be blocked at firewalls without affecting normal network operation
• Detectability: Large and frequent ICMP packets are telltale signatures

Mitigation

• Block ICMP at perimeter: Allow only essential ICMP (unreachable, fragmentation needed) and rate-limit echo
• ICMP inspection: Firewall deep inspection of ICMP payloads for protocol signatures
• Network monitoring: Alert on large ICMP packets and sustained ICMP sessions
• IDS/IPS rules: Deploy detection rules for known ICMP tunneling signatures
• Disable ping on servers: Use firewall rules to drop ICMP echo requests on production systems

Legitimate Uses

• Captive portal networks: Networks where only ping (ICMP) is allowed outbound
• Firewall testing: Penetration testers demonstrate ICMP as an exfiltration vector
• Legacy network diagnostics: Some diagnostic tools use ICMP for remote measurements