My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.
The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP data payload.
-p ADD 1 72.16.1.
21 MASK 255.255.
The IPS tagged it as Loki tunneling traffic - but it's limited to a single packet. I thought it could be a random grab from memory, but I saw the exact same packet a few days later.
Has anyone seen anything like this before?