P-660H/HW/W-T Series User’ Guide

(ICMP) echo request packets (pings). Since the destination IP address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo request packet to all hosts on the network. If there are numerous hosts, this will create a large amount of ICMP echo request and response traffic. If a hacker chooses to spoof the source IP address of the ICMP echo request packet, the resulting ICMP traffic will not only clog up the "intermediary" network, but will also congest the network of the spoofed source IP address, known as the "victim" network. This flood of broadcast traffic consumes all available bandwidth, making communications impossible.

Figure 49 Smurf Attack

10.4.2.1 ICMP Vulnerability

ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert:

Table 34 ICMP Commands That Trigger Alerts

5REDIRECT

13TIMESTAMP_REQUEST

14TIMESTAMP_REPLY

17ADDRESS_MASK_REQUEST

18ADDRESS_MASK_REPLY

10.4.2.2 Illegal Commands (NetBIOS and SMTP)

The only legal NetBIOS commands are the following - all others are illegal.

Table 35 Legal NetBIOS Commands

MESSAGE:

REQUEST:

POSITIVE:

VE:

123

Chapter 10 Firewalls