An ICMP flood, often called a ping flood, is usually described as a solved problem: block ping at the firewall and it goes away. That holds only when the filter sits upstream of the link that fills and when the block does not take out the ICMP messages the network depends on, and a DDoS test exists to find out which case you are in. It is a Layer 3 member of the volumetric attack family: the attacker sends ICMP packets, usually echo requests, at a higher rate than the target's link or host can take.
How an ICMP flood works
The classic form sends ICMP type 8, echo request, and relies on the target answering each one with a type 0 echo reply. The name comes from the -f flag of the Unix ping tool, which sends requests as fast as replies return or a hundred a second, whichever is faster. Attack tooling drops the wait altogether.
Two things make it more costly than its simplicity suggests. First, it is a packets-per-second attack as much as a bits-per-second one: a minimum-size echo request is under 100 bytes on the wire, so a modest bandwidth carries millions of packets, each one an interrupt and a trip through the kernel's network path. Second, the target pays twice. Every request that reaches a responding host produces a reply of the same size, so a flood that fills the inbound direction generates an equal outbound load, which hurts most on links where the upstream is the smaller side. Linux, for example, rate-limits the ICMP error messages it generates by default but not echo replies.
Floods are not limited to echo. Destination-unreachable and other types can be sent the same way, and some of those hit a stateful device harder than the host behind it, the pattern behind the BlackNurse attack. The reflected variant, where a broadcast address answers on the attacker's behalf, is the smurf attack.
Why blocking ping is not the answer
Dropping echo requests at your own firewall stops the host answering, but the packets have already crossed the link, so a flood larger than the circuit still takes it down. The drop has to happen at the provider or scrubbing tier.
A blanket ICMP drop also breaks things. Path MTU discovery depends on ICMP: IPv4 uses type 3 code 4, "fragmentation needed", and IPv6 uses Packet Too Big, which RFC 4890 says must never be filtered. Block those and connections that send full-size packets across a smaller-MTU path hang silently while small requests keep working, a failure that looks nothing like a DDoS and is hard to trace back. The correct control is rate limiting of echo traffic at the edge, with the error types needed for the network to function allowed through.
What a DDoS test measures
A test finds where the flood saturates first, the link in bits per second or the host and firewall in packets per second, and whether the edge policer engages before either. It then checks what the mitigation cost: whether large transfers still complete across paths that need PMTU discovery while ICMP is being policed, and how much outbound bandwidth the replies consumed before the policer engaged. ICMP is one of several places where a blunt block quietly breaks something legitimate, and DDoS resilience testing sets out the rest.