I told them that icmp is a protocol, and doesn't use the same notion of ports like tcp/udp. However, it is often shown as port 0 in certain vendors logs. It's really a type 0,1,3,8 or some combination of those that they are looking for, not port.