I know ICMP uses IP datagrams to reply to echo requests but what is above that?
ICMP is actually part of IP. There is no protocol above IP that responds to an ICMP Echo Request. ICMP itself, as part of IP, responds with the ICMP Echo Reply. From RFC 792 INTERNET CONTROL MESSAGE PROTOCOL:
ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module.
ICMP is a protocol itself. See INTERNET CONTROL MESSAGE PROTOCOL. There is no higher level protocol required. For example, in Cisco IOS, some ICMP access lists look like:
access-list 102 permit icmp any any echo-reply access-list 100 permit icmp 192.168.1.0 0.0.0.255 any echo access-list 100 permit icmp any 192.168.1.0 0.0.0.255 echo-reply access-list 100 deny icmp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 time-exceeded
Notice port numbers are not specified because there are none.