Search 250 million research papers

Internet Control Message Protocol

Walter Goralski · Elsevier eBooks · 2009

Cited by 1

Internet Control Message Protocol

Marc Blanchet · 2005

This chapter contains sections titled: ICMP Neighbor Discovery Hop Limit Set to 255 Managing ICMP on Hosts and Routers Summary References

Cited by 32

Internet Control Message Protocol

J. Postel · 1981

Cited by 158

Internet Control Message Protocol (ICMPv6

A. Conta, S. Deering, Cisco Systems et al. · 1998

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards " (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2006). This document describes the format of a set of control messages used in ICMPv6 (Internet Control Message Protocol). ICMPv6 is the

Cited by 0

Internet Control Message Protocol for IPv6 (ICMPv6)

2005

Cited by 0

Internet Control Message Protocol for the Internet Protocol Version 6", RFC 2463

S. Deering, Xerox Parc, Status Of This Memo · 1998

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards " (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This document specifies a set of Internet Control Message Protocol (ICMP) messages for use with version 6 of the Internet Protocol (IPv6). The Internet Group Management Protocol (IGMP) messages specified in STD 5, RFC 1112 have been merged into ICMP, for IPv6, and are included in this document.

Cited by 0

Internet Control Message Protocol for the Internet Protocol Version 6 (IPv6)", RFC 2463

S. Deering, Xerox Parc, Status Of This Memo · 1998

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards " (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This document specifies a set of Internet Control Message Protocol (ICMP) messages for use with version 6 of the Internet Protocol (IPv6). The Internet Group Management Protocol (IGMP) messages specified in STD 5, RFC 1112 have been merged into ICMP, for IPv6, and are included in this document.

Cited by 0

ICMPTend: Internet Control Message Protocol Covert Tunnel Attack Intent Detector

Tengfei Tu, Wei Yin, Hua Zhang et al. · Computers, materials & continua/Computers, materials & continua (Print) · 2021

The Internet Control Message Protocol (ICMP) covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission. Its concealment is stronger and it is not easy to be discovered. Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions. In this paper, we propose an ICMP covert tunnel attack intent detection framework ICMPTend, which includes five steps: data collection, feature dictionary construction, data preprocessing, model construction, and attack intent prediction. ICMPTend can detect a variety of attack intentions, such as shell attacks, sensitive directory access, communication protocol traffic theft, filling tunnel reserved words, and other common network attacks. We extract features from five types of attack intent found in ICMP channels. We build a multi-dimensional dictionary of malicious features, including shell attacks, sensitive directory access, communication protocol traffic theft, filling tunnel reserved words, and other common network attack keywords. For the high-dimensional and independent characteristics of ICMP traffic, we use a support vector machine (SVM) as a multi-class classifier. The experimental results show that the average accuracy of ICMPTend is 92%, training ICMPTend only takes 55 s, and the prediction time is only 2 s, which can effectively identify the attack intention of ICMP.

Cited by 2Open access

Analysis and application of covert channels of internet control message protocol

Xueguang Zhou, Huanguo Zhang · Wuhan University Journal of Natural Sciences · 2006

Based on the analysis of the covert channel's working mechanism of the internet control message protocol (ICMP) in internet protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6), the ICMP covert channel's algorithms of the IPv4 and IPv6 are presented, which enable automatic channeling upon IPv4/v6 nodes with non-IPv4-compatible address, and the key transmission is achieved by using this channel in the embedded Internet terminal. The result shows that the covert channel's algorithm, which we implemented if, set correct, the messages of this covert channel might go through the gateway and enter the local area network.

Cited by 0

Time-to-Lie: Identifying Industrial Control System Honeypots Using the Internet Control Message Protocol

Jacob Williams, Matthew Edwards, Joseph Gardiner · arXiv (Cornell University) · 2024

The convergence of information and operational technology networks has created previously unforeseen security issues. To address these issues, both researchers and practitioners have integrated threat intelligence methods into the security operations of converged networks, with some of the most valuable tools being honeypots that imitate industrial control systems (ICS). However, the development and deployment of such honeypots is a process rich with pitfalls, which can lead to undiagnosed weaknesses in the threat intelligence being gathered. This paper presents a side-channel method of covertly identifying ICS honeypots using the time-to-live (TTL) values of target devices. We show that many ICS honeypots can be readily identified, via minimal interactions, using only basic networking tools. In a study of over 8,000 devices presenting as ICS systems, we detail how our method compares to an existing honeypot detection approach, and outline what our methodology reveals about the current population of live ICS honeypots. In demonstrating our method, this study aims to raise awareness of the viability of the TTL heuristic and the prevalence of its misconfiguration despite its presence in literature.

Cited by 1Open access

Time-to-Lie: Identifying Industrial Control System Honeypots Using the Internet Control Message Protocol

Jacob J. Williams, Matthew Edwards, Joseph Gardiner · Bristol Research (University of Bristol) · 2025

The convergence of information and operational technology networks has created previously unforeseen security issues. To address these issues, both researchers and practitioners have integrated threat intelligence methods into the security operations of converged networks, with some of the most valuable tools being honeypots that imitate industrial control systems (ICS). However, the development and deployment of such honeypots is a process rich with pitfalls, which can lead to undiagnosed weaknesses in the threat intelligence being gathered. This paper presents a side-channel method of covertly identifying ICS honeypots using the time-to-live (TTL) values of target devices. We show that many ICS honeypots can be readily identified, via minimal interactions, using only basic networking tools. In a study of over 8,000 devices presenting as ICS systems, we detail how our method compares to an existing honeypot detection approach, and outline what our methodology reveals about the current population of live ICS honeypots. In demonstrating our method, this study aims to raise awareness of the viability of the TTL heuristic and the prevalence of its misconfiguration despite its presence in literature.

Cited by 0Open access

Automatic Traffic-Based Internet Control Message Protocol (ICMP) Model Generation for ns-3

Jaime C. Acosta · 2015

Abstract : The urgency of measuring the security posture of network systems continues to increase with the development of new technologies and the number of vulnerabilities that these introduce. The most effective way of testing these networks is through field tests on real systems in operational environments. Although this provides the highest level of accuracy, the disadvantages that arise with this approach can limit its efficiency and success. These challenges include high costs, time constraints, and the coordination efforts involved in the execution of these tests. One potential solution is the generation of system models that facilitate the continuous experimentation and testing on simulations of these networks in a laboratory environment. Models aid in the testing and analyzing of network systems, but as things stand today, there are limitations to this approach: models can lack synchronization with actual systems and must be built mostly from scratch. In this report, we introduce the ns-3 Model Generator; a tool aimed at automating the generation of protocol models and scenario files that can be run on the ns-3. Our focus for this work was to recreate the Internet Control Message Protocol (ICMP) Ping protocol and an ns-3 scenario using only a 10-second Wireshark network capture. Our results show that in many aspects, the autogenerated protocol is closer to ground truth.

Cited by 0

Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features

Haiying Duan, Baohui Wang · 2023

Covert tunnel is gradually used in threat attacks, such as remote control and data theft. In this paper, we propose a baseline feature-based malicious traffic detection method for Internet Control Message Protocol (ICMP) covert tunnel. We first analyze the packets involved in benign ICMP traffic and ICMP covert tunnel, and determine five features that show better ability to differentiate benign ICMP traffic and ICMP covert tunnel, including the average length of packet payloads, the frequency of packets, the session duration, the ratio of request and reply, and the entropy value of payload. Then, we employ a variety of machine learning models to build binary classifiers for the detection of ICMP covert tunnel. A set of experimental results show that the best detection precision, recall and Fl value of the proposed method are as high as 99.51%, 99% and 99.48%, respectively. Meanwhile, the proposed method has millisecond traffic parsing and detection analysis capabilities, which can be applied to the detection of ICMP covert tunnel in real-world scenarios.

Cited by 0

Port-Knocking with the usage of Web, Internet control message protocol and Tunneling (PWIT)

Pourvahab, Mehran, Ebrahimi Atani, Reza, Shavanddasht, Milad · Figshare · 2025

This paper was published in 6th National Conference Iran’s Scientific Society on Command, Control, Communications, Computer and Intelligence (C4I), 2012/11, Shahid Beheshti University, Tehran, IR, https://www.researchgate.net/publication/388175210_Port-Knocking_with_the_usage_of_Web_Internet_control_message_protocol_and_Tunneling_PWIT<br><br>Providing the facility of an open port for public is example of sending an invitation to an intruder. Unfortunately, lots of computer services like SMTP and HTTP need to be with open port for public. Although there are the other services that don't need to be available, and whenever we need them, must be available for. Therefore, with the use of Port-Knocking technique, with the use of sending invisible Knocks on the close port, enable us to find the level of requirement availability of ports or necessity of services. In this paper a novel method called "Pro-Knocking with the usage of Web, Internet control message protocol and Tunneling" , with the creation of an invisible service for hacking like DoS, and also with the use of Tunneling for reduction of NAT-Knocking and more complexity at the Knock operation, password and usage of ICMP at the same time to prevent Sniffing. This method for users would be cause of deletion specific and complex programs, for knocking process and also successfully run and implementation on MikroTik RouterOs.

Cited by 0Open access

Port-Knocking with the usage of Web, Internet control message protocol and Tunneling (PWIT)

Pourvahab, Mehran, Ebrahimi Atani, Reza, Shavanddasht, Milad · Figshare · 2012

This paper was published in 6th National Conference Iran’s Scientific Society on Command, Control, Communications, Computer and Intelligence (C4I), 2012/11, Shahid Beheshti University, Tehran, IR, https://www.researchgate.net/publication/388175210_Port-Knocking_with_the_usage_of_Web_Internet_control_message_protocol_and_Tunneling_PWIT<br><br>Providing the facility of an open port for public is example of sending an invitation to an intruder. Unfortunately, lots of computer services like SMTP and HTTP need to be with open port for public. Although there are the other services that don't need to be available, and whenever we need them, must be available for. Therefore, with the use of Port-Knocking technique, with the use of sending invisible Knocks on the close port, enable us to find the level of requirement availability of ports or necessity of services. In this paper a novel method called "Pro-Knocking with the usage of Web, Internet control message protocol and Tunneling" , with the creation of an invisible service for hacking like DoS, and also with the use of Tunneling for reduction of NAT-Knocking and more complexity at the Knock operation, password and usage of ICMP at the same time to prevent Sniffing. This method for users would be cause of deletion specific and complex programs, for knocking process and also successfully run and implementation on MikroTik RouterOs.

Cited by 0Open access

A Security Policy Protocol for Detection and Prevention of Internet Control Message Protocol Attacks in Software Defined Networks

Edeh Michael Onyema, M. Anand Kumar, Sundaravadivazhagan Balasubaramanian et al. · Sustainability · 2022

Owing to the latest advancements in networking devices and functionalities, there is a need to build future intelligent networks that provide intellectualization, activation, and customization. Software-defined networks (SDN) are one of the latest and most trusted technologies that provide a method of network management that provides network virtualization. Although traditional networks still have a strong presence in the industry, software-defined networks have begun to replace them at faster rates. When network technologies emerge at a steady rate, SDN will be implemented at higher rates in the upcoming years in all fields. Although SDN technology removes the complexity of tying control and data plane together over traditional networks, certain aspects such as security, controllability, and economy of network resources are vulnerable. Among these aspects, security is one of the main concerns that are to be viewed seriously as far as the applications of SDN are concerned. This paper presents the most recent security issues SDN environment followed by preventive mechanisms. This study focuses on Internet control message protocol (ICMP) attacks in SDN networks. This study proposes a security policy protocol (SPP) to detect attacks that target devices such as switches and the SDN controller in the SDN networks. The mechanism is based on ICMP attacks, which are the main source of flooding attacks in the SDN networks. The proposed model focuses on two aspects: security policy process verification and client authentication verification. Experimental results shows that the proposed model can effectively defend against flooding attacks in SDN network environments.

Cited by 41Open access

Distributed denial of service detection using stepping stone detection method in internet control message protocol attack

Nor Izham, Subri · UUM Electronic Theses and Dissertation [eTheses] (Northern University of Malaysia) · 2017

The Distributed Denial of Services (DDoS) is an imminent attack that can threaten cyber security even tough the attack is simple. The goal of DDoS attack is to disrupt the services that being provided by a server by forcing the server to a halt. This attack actually is an attack that being conducted by overwhelming the victim using large amount of host that sends request that need to be processed by the server. DDoS attack using ICMP as a medium prove to be a challenge to cyber security prevention system and application. This is because ICMP-based DDoS attack has a characteristic such as not containing malicious content. Therefore, ICMP-based DDoS attack is hard to be detected by cyber security prevention system and application. The goal of this research is to detect DDoS attack using Stepping Stone Detection (SSD) method. The objective of this research is to develop different approach to detect DDoS attack. There are six stages involved in this research which are analysis, instrument, design, experiment, data collection, and evaluation. The experiment is using testbed where actual hardware is used in a controlled environment where the data obtained is not polluted with other elements. Lastly, False Positive Rate (FPR) is compared so the efficiency of SSD-based method to detect DDoS can be identified. This research shows that SSD-based method obtained low FPR which is 0.206% rather than Snort that obtain 63.04%. This shows that SSD-based method is more efficient to detect ICMP-based DDoS attack than Snort in terms of FPR. As a conclusion, this research shows that SSD capable to detect ICMP-based DDoS attack and achieve the objectives of this research.

Cited by 0

Labelled Dataset on Distributed Denial‐of‐Service (DDoS) Attacks Based on Internet Control Message Protocol Version 6 (ICMPv6)

Selvakumar Manickam, Adnan Hasan Bdair AIghuraibawi, Rosni Abdullah et al. · Wireless Communications and Mobile Computing · 2022

The most dangerous attack against IPv6 networks today is a distributed denial‐of‐service (DDoS) attack using Internet Control Message Protocol version 6 (ICMPv6) messages. Many ICMPv6‐DDoS attack detection mechanisms rely on self‐created datasets because very few suitable ICMPv6‐DDoS attack datasets are publicly available due to privacy and security concerns. When implemented in a real network, however, a detection system that relies on a dataset with incorrect packet or flow representation and contains unqualified features generates a large number of false alerts. The goal of this work is to create a comprehensive ICMPv6‐DDoS attack dataset that can be used for tuning, benchmarking, and evaluating any detection systems designed to detect ICMPv6‐DDoS attacks. The proposed datasets met the criteria for a good dataset, ensuring their usefulness to other researchers. A GNS3 network simulation tool is used to simulate an IPv6 network and generate ICMPv6 traffic for the dataset. The generated traffic contains both normal and abnormal ICMPv6 traffic, with the abnormal traffic containing ten different ICMPv6‐DDoS attacks based on RA and NS message flooding. Five classifiers were chosen, varying in terms of type, classification performance, and the number of features used, and the results were as follows: decision tree 80%, support vector machine 78%, naïve Bayes 80%, k ‐nearest neighbours 81%, and neural networks 81%. The proposed dataset has been shown to accurately represent attack traffic in tests, with a high detection accuracy and a low false‐positive rate.

Cited by 19Open access

Big Book of Internet Host Standards

Peter Loshin · Medical Entomology and Zoology · 2000

RFC 768 User Datagram Protocol RFC 791 Internet Protocol RFC 792 Internet Control Message Protocol RFC 793 Transmission Control Protocol RFC 919 Broadcasting Internet Datagrams RFC 922 Broadcasting Internet Datagrams in the Presence of Subnets RFC 950 Internet Standard Subnetting Procedure RFC 1112 Host Extensions for IP Multicasting RFC 1122 Requirements for Internet Hosts -- Communication Layers RFC 1123 Requirements for Internet Hosts -- Application and Support RFC 1127 A Perspective on the Host Requirements RFCs

Cited by 0

Status of this Memo Procedures and IANA Guidelines for Definition of New DHCP Options and Message Types

R. Droms · 2000

This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2000). All Rights Reserved. The Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a Transmission Control Protocol/Internet Protocol (TCP/IP) network. Configuration parameters and other control information are carried in tagged data items that are stored in the ’options ’ field of the DHCP message. The data items themselves are also called &amp;quot;options&amp;quot;. DHCP protocol messages are identified by the ’DHCP Message Type’ option (option code 51). Each message type is defined by the data value carried in the ’DHCP Message Type ’ option. New DHCP options and message types may be defined after the publication of the DHCP specification to accommodate requirements for conveyance of new configuration parameters or to accommodate new protocol semantics. This document describes the procedure for defining new DHCP options and message types. 1.

Cited by 0