Tracking down random ICMP

["Craig Chamberlain" <craig.chamberlain () Q1Labs com>]

Seem to be seeing more random bursts of ICMP traffic - sometimes
unidirectional - with remote destinations that are mostly inexplicable.
Wondering if it's a covert control channel of some sort - if so I can
see why they chose ICMP - often allowed through firewalls and it is
seems to be hard to determine the originating process in Windows.
 
Is there a tool that can determine which process ID is generating ICMP
packets or IRPs in Windows? TDImon seems to be TCP/UDP only. TCPview and
netstat apparently can't do it. 

TIA 
- Craig