This whitepaper discusses using ICMP as a covert tunnel for traffic. An example of this technique is tunneling complete TCP traffic over ping requests and replies. More technically it works by injecting arbitrary data into an echo packet sent to a remote computer. The remote computer replies in the same manner, injecting an answer into another ICMP packet and sending it back.
You can download it from the following link: https://packetstormsecurity.com/files/download/110602/ICMP_Covert_Channel.pdf
Source: https://packetstormsecurity.com/files/110602/Covert-Channel-Over-ICMP.html