Re: Smurfing

["Craig A. Huegen" <chuegen () quadrunner com>]

On Sat, 14 Feb 1998, William Allen Simpson wrote:

==>Wow, I was glad to see that all these wonderful folks are reading the
==>router requirements (RFC-1812, June 1995).  Good, good.
==>
==>What I'd like to understand is how smurf attacks can work, even with
==>directed broadcast on?  Isn't there a requirement (RFC-1122) from ages
==>past (October 1989) that ICMP not respond to broadcast or multicast
==>[page 38 et seq]?

Nope.  RFC 1122[1] says (also in my paper =):

---
   An ICMP Echo Request destined to an IP broadcast or IP
   multicast address MAY be silently discarded.

   DISCUSSION: 
      This neutral provision results from a passionate debate
      between those who feel that ICMP Echo to a broadcast
      address provides a valuable diagnostic capability and
      those who feel that misuse of this feature can too
      easily create packet storms.
---

Most stack implementors have chosen to respond to it because of its
troubleshooting value; then again, the date of the RFC shows why many
folks would tend to believe the threat of the attack wouldn't be very
large.

/cah

[1] RFC-1122, "Requirements for Internet Hosts - Communication Layers";
    R.T. Braden; October 1989.