Most Nmap users ignore ICMP, but professionals use it for covert discovery and intelligence gathering. This lecture unpacks ICMP's full utility in scenarios where TCP and UDP scans are blocked or filtered. You'll learn how to use non-standard ICMP types, interpret various unreachable messages, and craft effective host discovery strategies in highly restricted environments.

In-depth topics include:

• ICMP Echo Request, Timestamp Request, Address Mask Request, and their practical use

• How different operating systems respond to ICMP probes

• Interpreting Type 3 (Destination Unreachable) subcodes

• Detecting ICMP rate-limiting and avoiding it

• How to layer ICMP discovery with ARP and TCP-based methods for higher accuracy

• Using ICMP as a stealth recon tool in enterprise or cloud environments