Protecting Against Smurf Attacks; In This Chapter - Dell PowerConnect B-RX Configuration Manual

Protecting Against Denial of Service Attacks

In this chapter

In a Denial of Service (DoS) attack, a router is flooded with useless packets, hindering normal
operation. The BigIron RX includes measures for defending against two types of DoS attacks,
Smurf attacks and TCP SYN attacks.

Protecting against Smurf attacks

A Smurf attack is a kind of DoS attack where an attacker causes a victim to be flooded with ICMP
echo (Ping) replies sent from another network.
FIGURE 127
The attacker sends an ICMP echo request packet to the broadcast address of an intermediary
network. The ICMP echo request packet contains the spoofed address of a victim network as its
source. When the ICMP echo request reaches the intermediary network, it is converted to a Layer 2
broadcast and sent to the hosts on the intermediary network. The hosts on the intermediary
network then send ICMP replies to the victim network.
BigIron RX Series Configuration Guide
53-1001810-01
•
Protecting against Smurf attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 983
•
Protecting against TCP SYN attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 985
•
Displaying statistics due DoS attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 988
•
Clear DoS attack statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 988
How a Smurf attack floods a victim with ICMP replies
1
Attacker sends ICMP echo requests to
broadcast address on Intermediary's
network, spoofing Victim's IP address
as the source
2
If Intermediary has directed broadcast
forwarding enabled, ICPM echo requests
are broadcast to hosts on Intermediary's
network
Figure 127 illustrates how a Smurf attack works.
Attacker
Intermediary
3
The hosts on Intermediary's network
send replies to Victim, inundating Victim
with ICPM packets
Chapter
34
Victim
983