Which of the following protocols is a maintenance protocol and is normally considered a part of the IP layer, but has also been used to conduct denial-of-service attacks?

ICMP (Internet Control Message Protocol), defined in RFC 792, operates as a maintenance protocol within the IP layer and is used by diagnostic tools like ping and traceroute to report errors and test connectivity. Because it is connectionless and requires no handshake, attackers have weaponized it in volumetric DoS attacks such as ICMP flood attacks and the Smurf attack, where broadcast-amplified echo requests overwhelm a target. Its dual role as both a utility protocol and an attack vector is a well-known security concern.

L2TP (Layer 2 Tunneling Protocol) is a VPN tunneling protocol operating at the data link layer and is not a maintenance or error-reporting protocol associated with the IP layer.

TCP is a connection-oriented transport-layer protocol responsible for reliable data delivery and is not classified as an IP-layer maintenance protocol.

NNTP (Network News Transfer Protocol) is an application-layer protocol for distributing and reading Usenet newsgroup articles and has no role in IP-layer maintenance or DoS attacks.