Professional Documents
Culture Documents
Smurf Attacks
Smurf Attacks
net/publication/353141341
CITATIONS READS
7 862
Some of the authors of this publication are also working on these related projects:
All content following this page was uploaded by Shilpa Mehta on 10 July 2021.
I. Introduction
In IP address spoofing Internet Protocol[1,2,5] packets are
created with forged source IP address. The main aim of spoofing
is for hiding sender identity. In this attacker unauthorizingly
access computer or network showing as if malicious message
came from trusted machine by spoofing that machine address.
This spoofing can be used in denial of service attack where
victim flows with large traffic but attacker has no problem if
responses come from attack packets and spoofed address
packets are required for these attacks. Fig.2(a): ICMP Redirect Attack
Smurf attack[2-4] overflows network traffic which is a kind
of denial of service attack where with the help of spoofed
broadcast ping messages flooding of target system is done.
Generally smurf is used by attackers so that attack part
cannot be operated. Smurfing can make use of Internet
Protocol (IP) and Internet Control Message Protocol (ICMP).
Basically network nodes and their administrators use ICMP
for exchanging information regarding state of network. ICMP
ping other nodes to check whether they are operating or not.
A node which is operating basically sends an echo message
when we send any ping message. Fig.1 will explain the working
of smurf attacks. Fig. 2(b): ICMP Redirect Attack
IV. Conclusion
If filtering is done at edge of the network then load on the
network will increase. This method is not much efficient.It its
very difficult if we need to disable IP broadcast address at
each and every network router even though this is one of the
solution for smurf attack.For Ingress filtering network should
have information regarding which IP address it is connected to
in network where it can send which is not possible always. So
for a network having single connection through Internet cannot
know whether packet is spoofed or not.For Packet filtering if a Fig.4: Analysis of Smurf Attack
spoofed IP address lies within valid address range then it helps
in attacking .As source IP address is within valid range then it References
would be easier to trace packets.Linux Iptables basically avoid
IP spoofing and bad address attacks. With the help of ICMP [1] Zhenhai Duan, Xin Yuan, Jaideep Chandrashekar,
we can overcome IP spoofing using these Linux Iptables. Fig.4 “Controlling IP Spoofing Through Inter-Domain Packet
shows how smurf attack takes place and how to overcome by Filters”, IEEE INFOCOM, 2006
these attacks. [2] Abhrajit Ghosh, Larry Wong, Giovanni Di Crescenzo, Rajesh
Talpade, “InFilter: Predictive Ingress Filtering to Detect
Spoofed IP Traffic”, Proc. of the 25th IEEE International
Conference on Distributed Computing Systems Workshops
(ICDCSW’05) 1545-0678/05 , 2005 IEEE
[3] Sanjeev Kumar, “Smurf-based Distributed Denial of
Service (DDoS), Attack Amplification in Internet”, Second
76 International Journal of Computer Science and Technology w w w. i j c s t. c o m
ISSN : 2229-4333(Print) | ISSN : 0976-8491(Online) IJCST Vol. 2, Issue 1, March 2011