and if so, with what kind of data encapsulated?<p>i've observed this behavior in packet captures while blocking/unblocking/reblocking ICMP outbound ping.
Can you provide an example from network logs? ICMP packets are plain text readable [0]. What do you see?<p>> <a href="https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Datagram_structure" rel="nofollow">https://en.wikipedia.org/wiki/Internet_Control_Message_Proto...</a>