from collections import Counter
from scapy.layers.inet import ICMP, IP
from scapy.layers.inet6 import IPv6


def extract_icmp_activity(packets):
    summary = Counter()
    sources = Counter()

    for pkt in packets:
        if pkt.haslayer(ICMP):
            summary["total"] += 1

            if pkt.haslayer(IP):
                src = pkt[IP].src
            elif pkt.haslayer(IPv6):
                src = pkt[IPv6].src
            else:
                continue

            if pkt[ICMP].type == 8:
                summary["echo_request"] += 1
            elif pkt[ICMP].type == 0:
                summary["echo_reply"] += 1
            else:
                summary["other"] += 1

            sources[src] += 1

    flood_sources = [s for s, c in sources.items() if c > 100]

    return {
        "summary": dict(summary),
        "flood_sources": flood_sources,
    }
