How do you detect ICMP C2?

Detect ICMP C2 by the shape of the echo traffic: normal pings carry small fixed OS-default payloads, while tunnels inflate them with high-entropy ciphertext and produce abnormal request/reply ratios and sustained volume. Alert on oversized ICMP payloads (e.g. dsize above a tuned threshold) and score payload entropy per source in your NSM, baselining monitoring tools that send larger pings. For other non-HTTP channels, use Zeek protocol analysers to flag protocol/port mismatches and apply beacon-timing analysis to raw TCP/UDP connection logs.

Detecting ICMP and Non-HTTP Protocol C2

When HTTP and DNS are watched, attackers reach for ICMP and raw protocols. ICMP tunnels (e.g. icmpsh, Metasploit) stuff command and control into echo request/reply payloads; other channels ride raw TCP/UDP on odd ports. These are low-volume but noisy if you know the shape: payload size, entropy and request/reply ratios that normal utilities never produce.

Signals at a Glance

Signal	Where	ATT&CK
Oversized ICMP echo payloads (far above OS default)	Network, Zeek icmp	T1095
High-entropy data in echo request/reply	IDS payload inspection	T1095
Abnormal echo request:reply ratio / timing	Flow	T1095
Sustained raw TCP/UDP to one host on an odd port	Flow/Zeek conn	T1095
Protocol does not match port (e.g. non-HTTP on 80)	Zeek, DPI	T1571

Hunting ICMP Tunnels

Normal pings use small, fixed OS-default payloads. Tunnels inflate them and fill them with ciphertext. Alert on large or high-entropy ICMP payloads and on hosts generating sustained echo traffic:

# Suricata-style idea for oversized ICMP payload (tune threshold/baseline)
alert icmp any any -> any any ( \
  msg:"HUNT Large ICMP echo payload (possible tunnel)"; \
  itype:8; dsize:>256; \
  threshold:type both, track by_src, count 10, seconds 60; \
  classtype:policy-violation; sid:9000010; rev:1; )
# Pair with entropy scoring on payloads in Zeek/NSM and baseline your
# monitoring tools (some generate larger pings).

In NSM data, score ICMP payload entropy and volume per source; a workstation emitting many large, high-entropy echoes to one external host is a strong lead.

Other Protocol Channels

Protocol/port mismatch: use Zeek's protocol analysers to flag non-HTTP on 80/443 or any service speaking the wrong protocol for its port.
Raw TCP/UDP beacons: apply beacon-timing analysis to connection logs regardless of protocol — the rhythm shows up in conn.log too.
Odd-port persistence: sustained low-volume sessions to a single external host on an unusual port, especially from a server, deserve inspection.
Egress policy: alert on protocols that should never leave (e.g. SMB, RDP, raw ICMP to the internet) crossing the perimeter.

Vetted sources

Use Zeek protocol analysers and ICMP logs, Suricata/ET rules for tunneling, and payload-entropy scoring in your NSM. Baseline legitimate large pings from monitoring tools, and combine payload signals with beacon-timing analysis for raw TCP/UDP channels.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Hunting ICMP Tunnels

Other Protocol Channels

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Protocol Tunneling Detection