<![CDATA[The Internet Control Message Protocol (ICMP) is widely regarded as a diagnostic protocol through the ping mechanism, yet the flexibility of the ICMP payload field can be abused to establish a covert channel that hides data inside seemingly normal traffic. This study analyses and detects ICMP covert channels using payload inspection in Wireshark. The experiment was conducted on a controlled Windows host (192.168.18.17) with a gateway at 192.168.18.1, through three scenarios: a normal ping with a 32-byte payload as the baseline, a large ping (option -l 1000) with a 1000-byte payload as a covert-channel simulation, and a custom ICMP packet carrying a 17-byte plaintext marker generated with Scapy. Over nine labelled Echo Requests, the display filter icmp and data.len > 100 achieved a precision of 1.00, a recall of 0.80, and an F1 of 0.89, because the small Scapy packet bypassed the size threshold. Adding identifier and sequence-number anomalies and the readable string in the hex panel detected every covert packet (F1 = 1.00). The results show that payload inspection combining packet size, header behaviour, and content is an effective basis for detecting ICMP covert channels.]]>
Copyrights © 2026
