TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Smurf Attacks
VideoSecurityFree

DEMO: Smurf Attacks

A smurf attack is a reflected, amplified DDoS attack that exploits ICMP and directed broadcasts to overwhelm a victim machine with traffic from spoofed requests. Understanding its three core components—ICMP flooding, address spoofing, and directed broadcast—is essential for recognizing and defending against this threat.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A smurf attack is a specific and highly effective form of distributed denial-of-service attack built on three core mechanisms: ICMP flooding, reflective amplification, and directed broadcasting. Rather than sending attack traffic directly to a victim, the attacker spoofs the victim's IP address and transmits ICMP echo requests to the broadcast address of a remote network. Every active host on that network receives the request and automatically sends a reply to the spoofed source address—the victim—multiplying the attack traffic significantly without requiring additional resources from the attacker. The directed broadcast is what makes the reflection possible at scale. By targeting a broadcast address rather than individual hosts, a single spoofed packet generates responses from potentially dozens or hundreds of machines, all converging on the victim simultaneously. This amplification effect can saturate a target's network connection or overwhelm its ability to process traffic, effectively taking it offline. Tools such as hping3 on Kali Linux can demonstrate this behavior in a controlled lab environment, illustrating how quickly ICMP traffic accumulates on the victim's interface. Ethical hacking exercises using these techniques must always be conducted on authorized networks, as unauthorized use constitutes a serious criminal offense.

What you'll learn

What's covered

Smurf Attack

Key terms

Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Smurf Attack
A reflected DDoS attack that spoofs a victim's IP address to send ICMP requests to a network's broadcast address, causing all devices on that network to flood the victim with replies.
Directed Broadcast
A packet addressed to the broadcast address of a remote network that travels as unicast until reaching that network, then is delivered to all hosts on it.

Topics

Smurf Attack Ddos Icmp Network Security Ip Spoofing Directed Broadcast Networking

Transcript

We're going to get into the details of what a smurf attack is. Now, really, all the concepts that go into what a smurf attack is, I covered pretty well in other lessons, so I'm not going to recover all of those concepts.

The Three Keys to a Smurf Attack

Number one key factor to what a smurf attack is: a smurf attack is a very specific type of attack, but the number one key factor to it is that it is an ICMP flood attack.

The second key to a smurf attack is that it's a reflected DDoS attack. So that means that the attacking machine is attacking a victim by spoofing the address of this machine, and it's sending out on behalf of that, sending out ICMP packets, a request, and then those replies come back to the machine. So it's reflecting off of all of these machines to that victim machine.

The third key to this is that it's a directed broadcast. That's how it carries out its reflected attack. So in this case right here, here's the attacking machine, here is the victim machine right here. What this attacking machine is going to do is send a broadcast out to another network spoofing the address of the victim machine, and then all the machines within this network right here will respond back then to the victim, and then the victim gets attacked.

Carrying Out the Attack

So I'm going to show you how you can actually carry out this type of attack. But remember, this is for ethical hacking purposes only. Make sure you're only doing this on your own network or a network that you've gotten permission to carry out these types of attacks on.

I'm on my demo machine here, and what I'm going to first of all do is pop into a command prompt and type in ipconfig, and we're just checking out the IP address. So this is 10.110.194. This is the victim machine, so that's who we're attacking. So we'll close that.

I've got Wireshark up here so we can see the attack happen. I've got a Kali Linux box here. What we'll do is type in this: sudo hping3 10.1.30.255. So this is not this network, this is a different network, and it's the broadcast address on that network. We're doing a dash A, so we're spoofing, and we're spoofing this victim box here, 10.110.194. So the 194 box is what is going to be the victim machine; we're spoofing the address there. We're going to send an ICMP request which will reply back to this victim machine, and we're going to flood it. So we're going to hit enter here, and you can see then it floods this interface with just a ton of ICMP packets.

Attack Summary

Here's an attack card for that smurf attack. So the key components here is it's an ICMP flood attack, it's a reflected attack, and it uses the broadcast address. So you broadcast a network, and then all of the machines on the network get that request from the spoofed IP address, and then it gets reflected back to that victim machine. In this case, it is a server.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →