Counts ICMP Echo, or ping request, messages received by the device. Since this counts pings addressed to the gateway itself, a sustained high rate here, especially from many distinct sources, is the classic signature of a ping-flood or reconnaissance sweep against the gateway's own management or external IP, distinct from normal traffic that merely transits the box. Example: icmpInEchos jumping from a handful per hour, routine uptime monitoring, to thousands per minute from varied source addresses points at an active ping-flood rather than legitimate monitoring traffic.