What kind of ICMP message can be used by threat actors to map an internal IP network?

Threat actors can use the ICMP Echo Request and Echo Reply messages, commonly known as "ping", to map an internal IP network. Here's how it works:

1. The threat actor sends an ICMP Echo Request message (ping) to an IP address within the network.

2. If the IP address is active, it will respond with an ICMP Echo Reply message.

3. By systematically sending these requests to different IP addresses within the network, the threat actor can determine which IP addresses are active and potentially vulnerable to further attacks.

4. This process is often automated using a technique known as a "ping sweep", which quickly sends ICMP Echo Requests to a range of IP addresses.

5. The threat actor then analyzes the Echo Replies to map out the network, identifying active devices and their corresponding IP addresses.

6. This information can then be used for further attacks or reconnaissance activities.

It's important to note that many modern systems and networks are configured to ignore ICMP Echo Requests or limit their rate to mitigate this type of threat.