.jpg "Opportunities, Appliacation, Openings"){kind=small}
.jpg "Hand Job, Blow Job, Job Search, Monster Job"){kind=small}
.jpg "Project Manager, SOftware Engineer, SAP Consultant"){kind=small}
ICMP Flooding vs SMURF Attack—THE BRIANS AND SCOTT
A smurf attack is when a host sends ICMP echos to a directed broadcast address with a spoofed source. All devices accepting ICMP on the target network reply with ICMP echo-reply back to the spoofed source. The spoofed source is the victim of the attack. To avoid this attack you can either filter ICMP echo, echo-reply, or disable directed broadcast. In newer IOS versions directed broadcast is disabled by default.
A fraggle attack is the same as a smurf attack except it uses UDP echo instead of ICMP echo. Disabling directed broadcast will prevent this attack as well.
The original question is very nondescript with the notion that a “router is experiencing attack via ICMP and UDP flooding”. Depending on what specific type of traffic it is there are a variety of options. You could filter ICMP and UDP altogether, disable UDP small services like echo (which by default should be off), you could rate limit or police the traffic, you could disable ip unreachable, ip mask-reply… etc. So if this were an exam question you would ultimately have to get more clarification on what an “ICMP and UDP flooding” attack actually means.
HTH,
Brian McGahan, CCIE #8593 bmcgahan@internetworkexpert.com
Internetwork Expert, Inc. http://www.InternetworkExpert.com Toll Free: 877-224-8987 x 705 Outside US: 775-826-4344 x 705 24/7 Support: http://forum.internetworkexpert.com Live Chat: http://www.internetworkexpert.com/chat/
> —–Original Message—– > From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of > Chris Broadway > Sent: Tuesday, August 22, 2006 10:21 AM > To: Peter Plak > Cc: Victor Cappuccio; Dusty; David Redfern (AU); Aamir Aziz; > ccielab@groupstudy.com > Subject: Re: ICMP Flooding vs SMURF Attack—THE BRIANS AND SCOTT > > Group, > > Can we get the “Brians” and/or Scott to give us their opinion on the > definitive ACL to log smurf, fraggle, and TCP syn attacks? I think > everyone > has an opinion but have not heard from the ones I consider to be the most > trusted sources. > > -Broadway > >
