GoFuckYourself.com - Adult Webmaster Forum - View Single Post

PersianKitty · 01-19-2003, 01:09 AM

A smurf begins when a single malicious user sends a stream of Internet Control Message Protocol, or ping, packets - used to determine if a machine is alive - to a target network's central "directed broadcast" address, which is rarely used, but easily obtained. This address pings all the machines - often 255 boxes or more - on the target network.

Each of the hundreds of hosts on that target network will dutifully respond with a "yes, I'm here" answer packet back to what they understand to be the ping's origin address. But the cracker has forged the source address of the originating ping packets.

Instantly, the target network is hopelessly clogged..

OR
A smurf program builds a network packet that appears to originate from another address (this is known as spoofing an IP address). The packet contains an ICMP ping message that is addressed to an IP broadcast address, meaning all IP addresses in a given network. The echo responses to the ping message are sent back to the "victim" address. Enough pings and resultant echoes can flood the network making it unusable for real traffic.

One way to defeat smurfing is to disable IP broadcast addressing at each network router since it is seldom used. This is one of several suggestions provided by the CERT Coordination Center.

01-19-2003, 01:09 AM
PersianKitty Meow Media Inc. Industry Role: Join Date: Jul 2001 Location: In the valley of the sun, cactus, tacos, tequila, and nod Posts: 7,785	A smurf begins when a single malicious user sends a stream of Internet Control Message Protocol, or ping, packets - used to determine if a machine is alive - to a target network's central "directed broadcast" address, which is rarely used, but easily obtained. This address pings all the machines - often 255 boxes or more - on the target network. Each of the hundreds of hosts on that target network will dutifully respond with a "yes, I'm here" answer packet back to what they understand to be the ping's origin address. But the cracker has forged the source address of the originating ping packets. Instantly, the target network is hopelessly clogged.. OR A smurf program builds a network packet that appears to originate from another address (this is known as spoofing an IP address). The packet contains an ICMP ping message that is addressed to an IP broadcast address, meaning all IP addresses in a given network. The echo responses to the ping message are sent back to the "victim" address. Enough pings and resultant echoes can flood the network making it unusable for real traffic. One way to defeat smurfing is to disable IP broadcast addressing at each network router since it is seldom used. This is one of several suggestions provided by the CERT Coordination Center. Last edited by PersianKitty; 01-19-2003 at 01:10 AM..