ZyXEL Communications P-334WT Support Notes page 29

A Brute-force attack, such as 'Smurf' attack, targets a feature in the IP specification known as directed or
subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker flood a
destination IP address of each packet is the broadcast address of the network, the router will broadcast
the ICMP echo request packet to all hosts on the network. If there are numerous hosts, this will create a
large amount of ICMP echo request packet, the resulting ICMP traffic will not only clog up the
'intermediary' network, but will also congest the network of the spoofed source IP address, known as the
'victim' network. This flood of broadcast traffic consumes all available bandwidth, making
communications impossible.
12. What is IP Spoofing attack?
Many DoS attacks also use IP Spoofing as part of their attack. IP Spoofing may be used to break into
systems, to hide the hacker's identity, or to magnify the effect of the DoS attack. IP Spoofing is a
technique used to gain unauthorized access to computers by tricking a router or firewall into thinking
that the communications are coming from within the trusted network. To engage in IP Spoofing, a
hacker must modify the packet headers so that it appears that the packets originate from a trusted host
and should be allowed through the router or firewall.
13. Why traffic redirect/static/policy route be blocked by P-334WT?
P-334WT is a secure gateway for all data passing between the Internet and the LAN. For some
reasons (load balance or backup line), users may want traffic to be re-routed to another Internet
access devices while still be protected by Prestige. In such case, the network topology is the most
important issue. Here is a common example that people mis-deploy the LAN traffic redirect and
static route.
The above figure indicates the "triangle route" topology. It works fine if you turn off firewall function