The ICMP Protocol may seem harmless at first glance. Its goals and features were outlined in RFC 792 (and later cleared in RFCs 1122,1256, 1349, 1812), as a way to provide a means to send error messages. In terms of security, ICMP is one of the most controversial protocols in the TCP/IP protocol suite. The risks involved in implementing the ICMP protocol in a network are the subject of this lecture. First we will outline the basics, going over the ICMP protocolâs characteristics. We will briefly introduce Host Detection methods using the various ICMP query message types with some elementary examples. Next we will overview the process of some Advanced Host Detection methods mainly centered in eliciting an ICMP error message back from the probed machines. Methods that allow us to map entire networks and understand ACL filtering devices protecting networks will be used during the course of the lecture. Some of the above mentioned methods also allow us to bypass weak firewalls. Recent methods of operating system fingerprinting discovered by the ICMP project (www.sys-security.com) will also be presented. Some of the methods will deal with ICMP Query Replies produced for a crafted ICMP Query, while other methods will deal with ICMP Error messages produced by the targeted machine as a result of a crafted eliciting error query. Some of the methods allow a malicious computer attacker to clearly identify a flavor of an operating system including Microsoft Windows 2000 machines, and to isolate certain groups of operating systems. We will also introduce ways to identify those fingerprinting attempts. New methods currently being researched by Ofir Arkin, which deal with Passive Fingerprinting with the ICMP protocol, will be discussed as well. With passive fingerprinting we, for example, will be able to have a clear distinction between the various Microsoft based Operating Systems. At the end of the talk a few minutes will be spent on some considerations necessary for firewall policy design.