How does a Smurf attack work?

How does a Smurf attack work?

• A. Spoof the target address and ping the broadcast address.
• B. By sending large volumes of legitimate traffic from compromised hosts.
• C. By exploiting DNS to redirect traffic to the attacker.
• D. By overloading a router's CPU with fragmentation.

Answer: (A)

Smurf attacks rely on using spoofed source addresses and ICMP Echo requests sent to a network’s broadcast address. The attacker sets the source IP to be the victim’s address and sends the ping to the broadcast address of a subnet. All hosts on that subnet that hear the broadcast reply to the spoofed address, so the victim receives a flood of ICMP Echo Replies. This amplification overwhelms the victim’s network resources, causing a denial of service. The other described methods depict different attack types: flooding with legitimate traffic from compromised hosts points to a botnet-based volumetric attack, exploiting DNS to redirect traffic refers to DNS-based amplification, and overloading a router’s CPU with fragmentation describes fragmentation-based overload methods.

Smurf attacks rely on using spoofed source addresses and ICMP Echo requests sent to a network’s broadcast address. The attacker sets the source IP to be the victim’s address and sends the ping to the broadcast address of a subnet. All hosts on that subnet that hear the broadcast reply to the spoofed address, so the victim receives a flood of ICMP Echo Replies. This amplification overwhelms the victim’s network resources, causing a denial of service.

The other described methods depict different attack types: flooding with legitimate traffic from compromised hosts points to a botnet-based volumetric attack, exploiting DNS to redirect traffic refers to DNS-based amplification, and overloading a router’s CPU with fragmentation describes fragmentation-based overload methods.