ICMP Flood

lastmod 2018-08-17created 2015-04-301 edits

ICMP stands for Internet Control Message Protocol. This attack, also called a Smurf attack, is a variant of the flood DoS attack on the public Internet. It exploits the fact that, when a network device is misconfigured, packets sent to the broadcast address of a particular network can be delivered to every computer on the network rather than to one specific computer. In this case the network acts as a smurf amplifier. In this attack, the attacker sends a large number of IP packets with the target's address as the source address. The network's bandwidth is quickly exhausted, and legitimate packets cannot reach their destination. To counter DoS attacks on the Internet, services such as smurf amplifier registries record misconfigured networks that could be abused so that they can be dealt with.

A ping flood sends the target an overwhelming number of ping packets. It usually uses the ping command on Unix-like hosts. It is an easy attack because all it needs is more bandwidth than the target.

A SYN flood sends a flood of TCP/SYN packets, usually with a forged sender address. (SYN stands for SYnchronize Sequence Numbers and is a bit in the TCP packet header.) Each packet is treated as a connection request. The server creates a half-open connection process, sends a TCP/SYN-ACK packet, and waits for a packet from the sender address. (ACK is also a bit in the TCP packet header.) But because the sender address is forged, no response comes back. When these half-open connections fill up the number of connections available on the server, it cannot answer legitimate requests for as long as the attack continues.

See also

• DoS

Favorite site

• KLDP: ISPs blocking ICMP...
• ipTime "Suspected worm virus infection on this port" message
• Windows ICMP Flood Programing

Project

• Hyenae project site ¹

References