Which Protocol Does a SMURF Attack Use?
A Smurf Attack is an amplification DDoS attack that sends ICMP packets to the broadcast address of a network. These are typically sent with spoofed source addresses, but can also be delivered using other protocols such as UDP or TCP. The goal is to flood the target’s bandwidth and take it offline by overwhelming its resources.
How did the Smurf DDoS attack get its name?
The name “smurf” was given to this attack because it is similar in nature to a Smurfs cartoon. In the show, there are many small blue characters called Smurfs that live together with one very large evil looking character named Gargamel who chases after them and tries to eat them .
How does a smurf attack work on a network?
A smurf attack is a type of DDoS, or Distributed Denial of Service. In this case, the goal is to use as many computers from an internet-connected network as possible to flood the target’s bandwidth and take it offline by overwhelming its resources.
In order for a computer to launch such an attack on another machine, they must have an IP address that has permission to send ICMP packets.
The following is a list of protocols that can be used in the attack:
- ICMP (Internet Control Message Protocol)
- UDP (User Datagram Protocol)
- TCP (Transmission Control Protocol)
What does ICMP mean in a smurf attack?
ICMP stands for Internet Control Message Protocol. This protocol is used to send error messages, control packets and information related to the IP protocol itself.
What are the steps of an amplification DDoS attack using ICMP packets to flood another network with traffic?
An attacker sends spoofed ICMP Echo Requests to the broadcast address of a network using IP source address 202.54.22.33 and destination 192.168 .0.100
The router receives these requests, notes they are for computers on its own network (192 . 168 . 0 . x), then forwards them onto each computer on the network
The machine at 192.168 .0.100 receives these requests, notes they are for computers on its own network, and sends back ICMP Echo Replies to each of those IP addresses
Because the original sender spoofed their address as 202.54 .22 .33 , all replies go back to that address
The attacker receives all of these packets and sends them out with spoofed source addresses as if they came from the Linux machine at 192 . 168 . 0.100 , thereby flooding it with traffic
What can I do as a network administrator or computer user to protect myself from an amplification DDoS attack using ICMP?
Use firewalls that block all unknown protocols except those needed by the organization
If possible, use Access Control Lists (ACLs) to only allow the computers within a network that need to send ICMP packets
Limit or disable all protocols except those needed by an organization. This also includes disabling echo.
What is the difference between slowloris and smurf attack?
Slowloris is a type of DoS that works by holding as many connections to the website open for as long as possible. The attacker sends partial requests, but never completes them. This results in it taking longer and longer for legitimate users to access information on what they are trying to load onto their computer or mobile device .
A smurf attack is an amplification DDoS that uses ICMP packets to flood another network with traffic.
What are some countermeasures against SMURF attacks?
- Use network monitoring tools such as Snort which protocol does a smurf attack use.
- Routinely check your router’s logs for suspicious activity and traffic patterns.
- Disable ICMP routing if it is currently enabled on the network, or at least disable forwarding of all broadcast packets to every other host on the local subnet. This can be done by applying access lists to the interfaces themselves on Cisco routers.
- Use IPv (Internet Protocol) ingress filters.
What is the difference between UDP and TCP packets in a smurf attack?
TCP packets are connection-oriented. This means that before sending data, computers must establish an initial connection with each other. UDP does not require this initial handshake, making it faster to send information but also less secure because no error correction is used.
In a smurf attack, UDP packets are often used because they allow for faster data transfer and require less overhead to complete the attack.
Which of these protocols can be used in an amplification DDoS attack: ICMP UDP TCP Slowloris ?
Slowloris can be used in an amplification DDoS attack. UDP, ICMP and TCP are not protocols that can be used to perform a smurf attack.
Conclusion
A smurf attack is a type of DDoS attack that uses ICMP packets to flood another network with traffic. By using firewalls, ACLs, and disabling protocols that are not needed by an organization’s network you can protect yourself from amplification DDoS attacks. In a smurf attack, UDP packets are often used because they allow for faster data transfer and require less overhead to complete.
