Big corporate places can completely restrict things and prevent any traffic from internal hosts to the internet. You can use proxying for web browsing etc. and then monitor that to check for any unauthorised traffic.

Edited for spelling

ahem.

    # iptables -A FORWARD -p icmp --icmp-type echo-request -m length --length 86:0xffff -j DROP

Update: as for the number of packets, there is -m limit and other recipes.

Also, instead of using the plain limit match, check out hashlimit. It can apply a rate limit on a per sender, destination, or sender+destination basis. The recent match may also be of interest.

So you're going to have to do a little bit more configuration than just allow a maximum packet size if you're going to allow ICMP to transit at all you should also limit the allowed set of addresses (you should do that regardless, but echo can be used for amplification requests by virtue of the broadcast feature of the IP protocol). Hence the 'one step away'.

This was known as the 'smurf' attack. Fortunately this is now mostly a thing of the past. But poking holes in your firewall for ICMP is a delicate affair.