ICMP: Data Where None Expected

This protocol anomaly triggers when it detects ICMP data within an ICMP packet that should not contain data. This can indicate tunneling over ICMP.

Extended Description

An ICMP packet that contains data when it is not supposed to, is a protocol anomaly. Receiving such a packet may indicate that a nonstandard ICMP implementation is currently being used, or that some software, often malware, is transmitting data tunneling over ICMP. The impact of this anomalous situation depends on how an ICMP implementation handles such a malformed packet.

References

URL: http://www.freesoft.org/CIE/Topics/81.htm

Short Name

ICMP:EXPLOIT:NON-ZERO-DATA-LEN

Severity

Minor

Recommended

False

Recommended Action

None

ICMP: Data Where None Expected

Extended Description

References

Found a potential security threat?