Internet Control Message Protocol

I'm familiar with a ping sweep.

It sends an ICMP echo request, basically shouting, are you there down a hallway and waiting for an echo back.

Right.

But what is a SYN sweep? Why would we use that instead?

And I think the, that was very good that I feel like I should have, uh, created that fun quote.

And, and what it says is really, like, important also for NetBeez because we use a lot ICMP and ping to measure-

Mm-hmm

... connectivity and reachability.

Yes.

I think-

I want the ICMP echo reply.

Exactly.

Juniper firewall filter syntax, so the way they write an access list using firewall filters, it's more expressive and it's more flexible than what I'm aware of with most Cisco access lists.

So for example, in Junos, you can set an action as discard, which means silently drop, or reject, which is drop and send an ICMP unreachable message back to the sender.

So I guess ICMP is another episode we haven't done yet either, Internet Control Message Protocol.

Wow.

An example of ICMP would be ping.

When you send ping, you're actually sending an Internet Control Message Protocol echo request out, and you get an echo reply back.

Those are ICMP messages.

And there's a whole bunch of them.

It all comes down to manipulating the core mechanics of network protocols.

These tools heavily rely on ICMP echoes, what we universally call ping packets.

Just simple pings.

Yeah.

Ah, which brings us to the reality check.

Mm.

Because getting that pristine Zenmap layout assumes the network architecture is actually cooperating with your ICMP request.

Which it rarely does.

Um, even to the point there was one RAT where like, even like the WhoAmI lookup and the system info and all those things that you would normally see, uh, an executable run, um, for that discovery, uh, they're able to leverage .NET and like basically not even have a separate process kickoff for that type of activity.

Or they had a, um, like even a ping plugin, right? That mimicked how Windows ping looks, uh, as far as from an ICMP packet perspective, but only kicks off one ping, so it's not like a standard four, uh, rounds and then quit like Windows typically does.

Uh, so like that, um, that thought on performing pretty much the same behaviors, but in a, like, highly different way, um, so they can keep their TTPs the same, but execute them differently, uh, I think is very fascinating.

And so that kinda adds to the challenges, right? For some of the things we do 'cause we, we say the behaviors don't change.