SSH Over ICMP Because Your Firewall Still Thinks Ping Is Harmless
“we allow ICMP for path MTU and monitoring.” cool. so does the red team. ptunnel-ng just turned your echo requests into a TCP pipe, and now there is an sshd on the far side of a protocol your board slide called “diagnostics.”
ptunnel-ng between lab hosts 10.0.4.0/24 with synthetic pcap output. ICMP tunneling against networks you do not own is unauthorized access. use this to validate whether your icmp allow-lists are a liability, and to teach analysts what “ping that looks like a conversation” means in a pcap.what icmp tunneling actually is
ICMP echo request/reply packets have a data field. nothing in the RFC says that data has to be a boring timestamp from ping(8). tools like ptunnel / ptunnel-ng / icmpsh / hans encapsulate a TCP stream (or a shell) inside that payload, with sequence numbers and a magic header so both ends can demux. if intermediate gear forwards ICMP and does not clamp weird payload sizes, you have a covert pipe that survives “deny all inbound TCP except 443.”
step 1: build the pipe
sudo ptunnel-ng -r 10.0.4.20 -R 22 -v 4 # server
sudo ptunnel-ng -p 10.0.4.10 -l 2222 -r 10.0.4.20 -R 22 # clientlocal port 2222 on the client becomes SSH to 10.0.4.20, carried as ICMP between the two tunnel endpoints. no new TCP on the wire between them.
why defenders care
- ICMP volume: shells generate way more echo pairs than a monitoring probe.
- payload size variance: real ping is usually constant. tunnels breathe with TCP.
- magic headers / non-zero entropy in ICMP data (ptunnel magic, custom nonces).
- directionality: echo replies from hosts that never sent matching requests (asymmetry after NAT weirdness).
- process: a userspace binary with raw sockets or
CAP_NET_RAWthat is not your monitoring agent.
controls
- default-deny ICMP on segments that do not need it. “path MTU” is not a blank check for every VLAN.
- where ICMP is required, rate-limit and alert on pps / bandwidth thresholds.
- IDS signatures for known tunnel magics (ptunnel, icmpsh). treat hits as IR, not “informational.”
- remove
CAP_NET_RAWfrom random containers and developer laptops. yes, really.
sloth take
every decade we rediscover that a protocol we left open “for troubleshooting” is a protocol someone else will use for a shell. ICMP is not evil. your allow-list without monitoring is. either instrument it or turn it off. “but traceroute” is not a security architecture.
