ICMP Smurf Attacks and Prevention

What it is

A smurf attack is a denial of service attack that uses ICMP echo requests, a broadcast address and a forged source address.

The attacker never sends traffic straight at the victim. Instead, many innocent hosts send the replies, so the victim receives a flood from many places at once.

The attack depends on two weaknesses. Networks may answer pings sent to a broadcast address, and the source address of a packet can be faked.

How it works

A smurf attack turns one small request into many large replies, so the attacker multiplies the attacker's bandwidth.

The steps

1. The attacker picks a network that accepts traffic sent to its broadcast address.
2. The attacker sends an ICMP echo request to that broadcast address. The source address is forged and is set to the victim's address.
3. Every host on the network sees the broadcast and sends an echo reply.
4. All the replies go to the victim, not to the attacker.

For example, a network with 200 active hosts turns one request into about 200 replies. This is the amplification effect, and it grows with the size of the network.

Two roles

Your network can play two roles in a smurf attack. It can be the amplifier, when your hosts answer a broadcast ping. It can be the victim, when replies arrive from someone else's network.

Preventing the amplifier role

The main defence is to refuse ICMP that is addressed to a broadcast address. RouterOS can match the destination address type.

/ip firewall raw add chain=prerouting protocol=icmp dst-address-type=broadcast action=drop

This single raw rule drops any ICMP packet sent to a broadcast address, before tracking. It protects the router and the hosts behind it.

If you prefer filter rules, place them on the input and forward chains.

/ip firewall filter add chain=input protocol=icmp dst-address-type=broadcast action=drop
/ip firewall filter add chain=forward protocol=icmp dst-address-type=broadcast action=drop

The input rule protects the router itself. The forward rule stops a packet from reaching hosts on other networks behind the router.

Preventing forged sources

A smurf attack needs a forged source. Stop forged addresses at the edge of your network by dropping packets whose source cannot be valid.

/ip firewall address-list add list=bogons address=10.0.0.0/8
/ip firewall raw add chain=prerouting in-interface=ether1 src-address-list=bogons action=drop
/ip settings set rp-filter=strict

The first two commands drop private addresses that arrive on the WAN port. Reverse path filtering drops packets that arrive on an interface that is not the route back to their source.

Defending as the victim

If you are the victim, the flood has already crossed the WAN link. Your own router can only limit what it passes to the inside, so the real fix is upstream.

/ip firewall filter add chain=forward protocol=icmp icmp-options=0:0 in-interface=ether1 limit=50,20:packet action=accept
/ip firewall filter add chain=forward protocol=icmp icmp-options=0:0 in-interface=ether1 action=drop

This pair allows echo replies up to a rate and drops the excess. The numbers are only an example. Contact your provider if the link itself is full.

Related attacks

A Fraggle attack is the same idea with UDP echo instead of ICMP. The defence is also similar. Drop traffic to broadcast addresses from outside and close unneeded services.