Home / server / Questions / 815443
Accepted
Slipeer
Asked: 2016-11-17 23:24:42 +0800 CST

Is there any way to scan host or network for icmp tunnel server?

  • 772

I am looking for a tool that would be able to scan hosts for working on them iсmp tunnel server. For example ptunnel.

I want to check hosts for which there is a lot of suspicion outgoing pings from my network. I want to make this check automatically (as I will implement - is another question).

Nobody faced with such a tool?

firewall networking icmp

1 Answers

  1. Best Answer

    I have never faced such an issue before, but I think you can at least do something like the following. These are ideas that need to be studied further if you want to implement something.

    1. Check the sizes of incoming and outgoing ICMP packets. Normal ping packets have always the same size and they are usually small (64 bytes on Linux).
    2. Check the data pattern of ICMP packets. If they are just normal ping, they should not be changing. Actual data exchange will always be changing (opening connection, ack, data itself).
    3. If you are concerned about incoming ICMP traffic, you can just block them (allow only what needs to be allowed).
    • 1