ICMP, the Internet Control Message Protocol, is a network protocol used for diagnostics and control messages such as ping and traceroute. Unlike TCP or UDP, it is not mainly used to carry application data, which makes it easy to forget in security monitoring.
In cyber security, ICMP matters because attackers can abuse its payloads as a covert channel for commands, data, or beaconing. Malware may hide information in echo requests and replies, or use unusual ICMP volume and patterns to communicate without relying on obvious ports. Defenders should watch for unexpected ICMP from hosts that do not normally use it, mismatched request and reply behavior, oversized payloads, and ICMP generated by suspicious processes. Properly filtered and logged, ICMP can still support troubleshooting while also helping reveal stealthy activity.