I've been configuring my ASA and noticed that although I configured an access-list incoming on the external interface to allow pings of the external interface, the packets didn't appear to be hitting that access list.

I removed the parts of the access-list that I thought allowed the pings, but the pings are still successful. The packet-tracer tool seems to show them being permitted implicitly.

Any ideas?