I have a simple netfilter module to test icmp_hdr function: unsigned int hook_func( unsigned int hooknum, struct sk_buff *skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *)) { const struct iphdr *ip_header = ip_hdr(skb); if (ip_header && ip_header->protocol == IPPROTO_ICMP) { const struct icmphdr *icmp_header = icmp_hdr(skb); printk(KERN_INFO "ICMP type %d", icmp_header->type); } return NF_ACCEPT; } Then I start to PING the HOST. On CentOS 6 (2.6.32-754.12.1.el6.x86_64), he printed ICMP type is always 69 (INVALID). On CentOS 7 (3.10) the result is ICMP_ECHO (8), which is correct. Was it a bug?