Cisco OL-4015-08 User Manual page 90

General
Description
IP Directed Broadcasts
IP Proxy ARP
Cisco Router and Security Device Manager Version 2.2 User's Guide
4-14
You can enter a short description in this field. This description will be visible in
the theEdit Interfaces and Connections window. A description can help others
who might be less familiar with the router configuration to understand the purpose
of the configuration. A description such as "Accounting," or "Test Net 5" lets
SDM users know without their having to examine details of the configuration.
An IP directed broadcast is a datagram which is sent to the broadcast address of a
subnet to which the sending machine is not directly attached. The directed
broadcast is routed through the network as a unicast packet until it arrives at the
target subnet, where it is converted into a link-layer broadcast. Because of the
nature of the IP addressing architecture, only the last router in the chain, the one
that is connected directly to the target subnet, can conclusively identify a directed
broadcast. Directed broadcasts are occasionally used for legitimate purposes, but
such use is not common outside the financial services industry.
IP directed broadcasts are used in the extremely common and popular "smurf"
Denial-of-Service attack, and they can also be used in related attacks. In a "smurf"
attack, the attacker sends ICMP echo requests from a falsified source address to a
directed broadcast address, causing all the hosts on the target subnet to send
replies to the falsified source. By sending a continuous stream of such requests,
the attacker can create a much larger stream of replies, which can completely
inundate the host whose address is being falsified.
Disabling IP directed broadcasts causes directed broadcasts that would otherwise
be "exploded" into link-layer broadcasts at that interface to be dropped instead.
ARP is used by the network to convert IP addresses into MAC addresses.
Normally ARP is confined to a single LAN, but a router can act as a proxy for
ARP requests, making ARP queries available across multiple LAN segments.
Because it breaks the LAN security barrier, proxy ARP should be used only
between two LANs with an equal security level, and only when necessary.
Chapter 4 Edit Interface/Connection
OL-4015-08