3

I was reading about Smurf Attacks and how Smurf Amplifier Registry keeps track of servers used for amplifying the attack, then I wondered, can a request coming from anywhere broadcast it to all parts on a network?

For example, do routers come by default so that if they receive a message from the internet they actually will broadcast it to all nodes on the internal network? Wouldn't this mean it's very simple to ping the entire internet all at once?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7 '17 at 16:22
6

Broadcasts do not normally cross layer-3 (routers). Some routers can be configured to forward subnet broadcasts, but the limited broadcast (255.255.255.255) will not cross layer-3. The Cisco version is ip directed-broadcast, and it must be configured on each subnet for which you want it. This is considered dangerous, and it is highly discouraged.

Broadcasts are layer-2, which is why it is bounded by layer-3. Since broadcasts force an interruption of every host on a layer-2 domain, they are bounded by layer-3 by default. The Internet would be completely unusable if broadcasts went everywhere.

4
  • Sorry I'm new to this, what does mean "cross layer"?
    – Celeritas
    Dec 13 '15 at 10:31
  • 1
    The broadcast will not be forwarded across the layer-3 boundary. A router (layer-3 boundary) will not forward broadcasts to other layer-2 domains.
    – Ron Maupin
    Dec 13 '15 at 10:33
  • Yes, that's what I thought. So how is it a smurf attack can use "other servers" that are on a different network, to amplify their attack? e.g. smurf.powertech.no how could these servers be used?
    – Celeritas
    Dec 13 '15 at 10:38
  • 1
    If you read the Wikipedia article to which you link, there are some interesting notes: "Today, administrators can make a network immune to such abuse, therefore very few networks remain vulnerable to Smurf attacks." Also, "Until 1999, standards required routers to forward such packets by default. Since then, the default standard was changed to not forward such packets." This doesn't mean that many networks weren't updated. I know many people that ignore such updates and are of the mindset that you shouldn't touch it if it is working. I think they deserve what they get.
    – Ron Maupin
    Dec 13 '15 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.