The proposed ICMP normal model is defined by a maximum allowed ratio of the number of ICMP request and reply packets, since each normal ICMP message should be paired with a corresponding reply.