A network sensor shows a workstation sending ICMP echo requests to one external host every few seconds, with payloads much larger than usual and different content in each packet. Normal pings in the environment carry small fixed payloads. What does this most likely indicate?
Select an answer to reveal the explanation.
Short Explanation
A normal ping is like knocking on a door the same way every time. When you see every knock carry a different, oversized package, somebody's using ping as a delivery truck. The trap is calling it monitoring; uptime checks don't need a new payload in every packet.
Full Explanation
ICMP tunneling uses the data field of echo request and echo reply messages to carry arbitrary content. Because many networks permit ICMP for troubleshooting, an attacker can send stolen data outbound inside echo requests and receive commands in replies from an external server they control. The key indicators are payloads larger than the operating system default, payload content that varies from packet to packet, regular timing, and a single persistent external destination. Path MTU discovery uses ICMP destination unreachable messages indicating fragmentation needed, not a stream of large, varying echo payloads from the host. A legitimate uptime monitor typically sends small, fixed or patterned payloads, and it usually runs from a monitoring server rather than an ordinary workstation. A Smurf attack sends echo requests to a broadcast address with a spoofed victim source so that many replies flood the victim; it does not involve one workstation sending varied payloads to one external host. Exam caveat: blocking all ICMP breaks troubleshooting and path MTU discovery, so a better control limits outbound echo to approved destinations and inspects payload size. Operational check: capture a sample of the echo payloads, confirm they contain non-default data, and isolate the host for investigation.