An ICMP tunnel  (also known as ICMPTX) establishes a covert connection between two remote computers (a client and proxy), using ICMP echo requests and reply packets. An example of this technique is tunneling complete TCP traffic over ping requests and replies.
ICMP tunneling works by injecting arbitrary data into an echo packet sent to a remote computer. The remote computer replies in the same manner, injecting an answer into another ICMP packet and sending it back. The client performs all communication using ICMP echo request packets, while the proxy uses echo reply packets.
In theory, it is possible to have the proxy use echo request packets (which makes implementation much easier), but these packets are not necessarily forwarded to the client, as the client could be behind a translated address (NAT). This bidirectional data flow can be abstracted with an ordinary serial line.
This vulnerability exists because RFC 792, which is IETF's rules governing ICMP packets, allows for an arbitrary data length for any type 0 (echo reply) or 8 (echo message) ICMP packets.
ICMP tunneling can be used to bypass firewalls rules through obfuscation of the actual traffic. Depending on the implementation of the ICMP tunneling software, this type of connection can also be categorized as an encrypted communication channel between two computers. Without proper deep packet inspection or log review, network administrators will not be able to detect this type of traffic through their network.
Although the only way to prevent this type of tunneling is to block ICMP traffic altogether, this is not realistic for a production or real-world environment. One method for mitigation of this type of attack is to only allow fixed sized ICMP packets through firewalls to virtually eliminate this type of behavior.
- Daniel Stødle. "Ping Tunnel: For those times when everything else is blocked.".
- PD-Proxy a VPN that can tunnel IP over ICMP (and also UDP or TCP)
- Droid-VPN an Android app that can use PD-Proxy servers
- Wi-Free -a VPN that can tunnel IP over ICMP
- Tunnel Guru VPN that can tunnel IP over ICMP
- Troid-VPN Android VPN that can tunnel IP over ICMP
- itun Simple IP over ICMP tunnel
- Hans ICMP tunnel for Linux (server and client) and BSD MacOSX (client only)
- BlueBitter Proof of concept ICMP remote command and chat for Windows
- ICMP-Shell a telnet-like protocol using only ICMP
- PingTunnel Tunnel TCP over ICMP
- ICMP Crafting  by Stuart Thomas
- Malacious ICMP Tunneling : Defense Against the Vulnerability  by Abhishek Singh
- RFC 792, Internet Control Message Protocol
- Using the ICMP tunneling tool Ping Tunnel
- Project Loki" Article on ping tunneling in Phrack
- http://blog.brunogarcia.com/2012/03/icmp-for-stealth-transport-of-data.html ICMP tunnel with C# source code