TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Ping Flood (ICMP Flood) Attack
VideoSecurityFree

DEMO: Ping Flood (ICMP Flood) Attack

An ICMP flood, also known as a ping flood, is a denial-of-service attack that overwhelms a target device by sending a massive volume of ICMP echo requests, consuming its resources until it becomes unreachable. Understanding how this attack works—and how to execute it in a controlled environment—is foundational knowledge for anyone pursuing ethical hacking or network defense.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

ICMP, the Internet Control Message Protocol, was designed to handle control messaging between networked devices—signaling congestion, reporting errors, and testing connectivity. The ping command is its most recognized application, sending an echo request to a target and waiting for a reply to confirm the device is reachable. A ping flood turns this routine diagnostic tool into a denial-of-service weapon by removing the delay between requests and sending as many ICMP packets as possible in rapid succession, consuming the target's processing resources until it can no longer respond to legitimate traffic. The effectiveness of this attack depends heavily on bandwidth. An attacker must have greater outbound capacity than the target link can absorb; otherwise the flood never reaches a level sufficient to cause disruption. One key technique involves spoofing randomized source IP addresses on each outgoing packet. This distributes the reply traffic across fictitious addresses across the network rather than back to the attacking machine, preventing the attacker's own system from being overwhelmed by the volume of return packets it would otherwise receive. A practical demonstration using hping3 on Kali Linux illustrates how quickly a real web server can be brought down with this method. Within moments of launching the flood against a target IP, ping responses from a separate monitoring machine stop and the target's web interface becomes unreachable. Stopping the attack with a single keystroke immediately restores normal connectivity, underscoring both how simple the attack is to execute and how abruptly it can be reversed. This makes ICMP flood attacks an important concept for network defenders to understand, recognize, and mitigate.

What you'll learn

What's covered

ICMP Flood / Ping Flood

Key terms

Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Bandwidth
The maximum rate of data transfer across a network path, typically measured in bits per second.
hping3
A command-line network tool used to craft and send custom packets, commonly used in penetration testing to perform flood attacks such as ICMP floods.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.

Topics

Icmp Denial Of Service Hping3 Ethical Hacking Network Security Packet Flooding

Transcript

ICMP Flood / Ping Flood

We're going to take a look at an ICMP flood, or a ping flood. ICMP flood and ping flood are really essentially the same thing. ICMP is the protocol that we're using when we do a ping flood. The Internet Control Message Protocol was really designed for some messaging between devices, so that way they could flag things like, hey, there's a little bit of congestion, or something's going on, or there's some control with this, the ICMP protocol. But we also know it as ping, because we can actually use ICMP to test out links and to see if different pieces of equipment are up. So we can do an ICMP packet, and we would send an ICMP request, and then this machine would reply back and say, yeah, I'm up and running. Or we know it by the command that we use, which is ping. Ping is the program where we say, hey, are you up and running, and it says yeah, I'm up and running. So ICMP flood, or ping flood, is just sending a ton of those, enough to overwhelm the resources of a machine.

Now, typically when we do a ping, it will send out a ping and then there'll be a reply back, and then there'll be a delay until it sends the next one and says, are you still up? And then there'll be a reply back, and then another delay. In order to get rid of this delay, we have to turn the flood option on. The flood option is the thing that will send a ton of requests out to the machine, and so then it will overwhelm that machine.

Now, there are some bandwidth considerations and requirements. That is, let's say we're on dialup and the fastest we can have is a 56k modem. Well, our connection to the internet is so slow, we wouldn't be able to saturate any of the links that we're targeting if that was the case. So our bandwidth leading up to the server, or the link that we're trying to overwhelm, what we need to have is more capabilities than whatever those links are that we're trying to overwhelm, or, once again, the resource that we're trying to overwhelm.

Ethical Reminder

This is a very easy attack to carry out, and I'm going to show you how right now. However, just a reminder, this is for ethical hacking purposes only. Make sure you only do this on your own equipment, on your own network, or on a network that you have permission to carry out these type of attacks. Otherwise, it's considered cyber crime and unethical.

Carrying Out the Attack

I'm on my demo laptop right here, and I'm connected to 10.1.30.23. This is a web server that I'm connected to, and I can just hit refresh to show you that it is connected to it. And then I also have this command window. So what we're going to do is we're going to actually ping this, 10.1.30.23, and we're just going to do a continuous ping. That way we can see what happens when we carry out this attack.

I brought up our Kali box here. So what we're going to do is sudo hping3, and where we're trying to hit, which is 10.1.30.23. We're going to do this flood flag, and so that's the flood of where it's going to send more than one ICMP packet, as much as it can. And then we're going to do this random source flag. What that is doing is it's creating random sources for the source address. It's creating a bunch of different ones, so the reply is not going to come back to this machine. It's going to go to other fictitious machines that it's making up here. So then we're going to do ICMP, so that's the type of attack we're going to launch.

So I'm going to hit enter on this. It's starting that flood mode. As we can see, it's no longer connecting here, so we're no longer able to ping it on our demo laptop. I'm going to hit refresh on the web page, and you can see it's spinning, so it's no longer connecting to the web browser on this. So now we no longer have connectivity.

What I'm going to do is bring up that Kali box again. We're going to hit Ctrl+C and watch the spin that's happening over here. As soon as I hit Ctrl+C, now it's gone away. So the website now is being accessible again, and we're getting our pings back through again. So there it is. A simple command, and we've brought this web server down.

Why the Random Source Matters

A little more about that random source, that's coming from random source addresses. Even though it's all coming from this machine right here, we're sending it out with machines from other parts of the network. The reason why this is important is because if we were to send all of it from the machine address, all of the replies would come back directly to this machine. Well, now that this machine is both sending and receiving all of these ICMP packets, it could overwhelm the resources of this machine. So by randomizing the source address, it's coming from all these fictitious machines all around the network, and so therefore this is where the machine is going to reply back to. So therefore then it's not going to overwhelm our attacking machine.

So here's that attack on an ICMP flood, also known as a ping flood. We're just overwhelming a device's resources with ICMP requests.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →