What is a smurf attack?
Definition
A smurf attack is a denial-of-service attack where the attacker sends network ping requests to many devices with the victim's address forged as the sender, so all the replies flood the victim and knock it offline.
- Category
- Attacks
- Also called
- smurfing attack, ICMP smurf attack
- Last updated
CISA describes a smurf attack as one where the attacker sends ICMP broadcast packets to many hosts while forging the victim's IP address as the source. The hosts all reply to the victim, which gets more traffic than it can handle. ICMP is the protocol behind the "ping" tool.
Step by step
- The attacker picks a target IP address.
- They send a ping to a network's broadcast address, so every device on that network receives it.
- They forge the victim's address as the sender.
- Every device replies to the victim at once.
- The victim's connection is saturated and legitimate traffic can't get through.
The attacker needs little bandwidth of their own, because the network does the amplifying.
An example
An attacker aims at a small gaming server. They send one forged ping to a network with hundreds of devices. Hundreds of replies hit the server for each ping, and players start timing out.
Smurf attack vs. other attacks
- A DoS attack is any attack that makes a service unavailable. A smurf attack is one type.
- A DDoS attack uses many attacking machines. In a smurf attack the other machines are unwitting reflectors, not compromised ones.
- Spoofing is the forged sender address that makes it work.
Does it affect you?
Mostly it targets organisations and servers. Modern networks are configured not to answer broadcast pings, so the classic smurf attack is rare today. For an ordinary person, the main lesson is that forged sender details are easy, which is also why scam calls and texts can fake their number.
How to protect yourself
- 1
Rate-limit ICMP traffic
CISA's DDoS guidance lists rate-limiting ICMP traffic and setting ICMP flood thresholds on firewalls as mitigations.
- 2
Don't answer broadcast pings
Network operators can configure routers and hosts so they don't reply to ICMP broadcast requests, which removes the amplifier.
- 3
Filter forged addresses
Operators can drop traffic that claims an address that can't come from where it entered the network.
- 4
Talk to your provider
If you're under sustained attack, contact your internet provider or hosting provider.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a smurf attack a DDoS attack?
It's a denial-of-service attack that works like a distributed one because many machines send the replies, but those devices are tricked, not taken over.
Are smurf attacks still a threat?
The classic form is rare because most networks no longer answer broadcast pings. Similar reflection and amplification techniques are still used.
Sources
Something wrong or out of date? Tell us and we'll re-check it.