ICMP (Internet Control Message Protocol)
- Description
-
A network layer protocol utilized by network devices to diagnose communication problems. ICMP is primarily used to determine whether data is reaching its intended destination promptly. Additionally, network devices, such as routers, utilize the ICMP protocol for error reporting when network issues prevent the delivery of data packets.
Hackers have also found ways to use ICMP messages maliciously, such as Ping of Death (PoD) attacks, Smurf attacks, and ping flood attacks. While few networks are vulnerable to PoD and Smurf attacks today, most systems remain susceptible to ping flood attacks. In corporate networks, ICMP traffic commonly indicates ping requests, and a certain amount of ICMP traffic is expected. However, a sharp increase in ICMP traffic over a short period usually indicates malicious activity. Therefore, ICMP traffic is worth monitoring.
NXLog Agent provides the Packet Capture input module to capture network traffic. You can use it in conjunction with the Event Correlator processor module to define a threshold for expected ICMP traffic and generate an alert if exceeded.
- Also known as
-
ICMP protocol
- See also