Network Topology Discovery via ICMP Host Sweep

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects network topology discovery attempts via ICMP host sweeps. It triggers an alert when a source IP sends 50 or more ICMP echo requests (type 8) within a 10-second window to the local network. This behavior is indicative of an attacker trying to identify active hosts on a network.