Which of the following are indicators of ICMP tunneling?

• A. SSH inside ICMP tunneling
• B. Large payloads, unusual packet sizes, high volume
• C. DNS queries to domain names
• D. Mapping IP addresses to MAC addresses

Answer: (B)

ICMP tunneling leaves telltale signs in how ICMP traffic appears. The data being carried through the tunnel ends up in the ICMP payloads, so you’ll often see unusually large ICMP payloads, odd packet sizes, and a high volume of ICMP traffic that doesn’t match typical diagnostic ping behavior. In normal networks, ICMP echo requests and replies are small and infrequent, used simply to check reachability. When you observe big ICMP payloads paired with a spike in ICMP traffic, it strongly suggests a covert channel is being used. The other choices point to different tunneling methods or unrelated protocols (SSH-over-ICMP, DNS tunneling, or ARP/MAC mapping), which are not indicators of ICMP tunneling itself.