What is a smurf attack?

02The amplification maths

The multiplier is simply how many hosts respond to a broadcast. In his original write-up Craig Huegen gave a concrete example: an attacker on a T1 line sending a 768 kbit/s stream of echo requests at a broadcast network of 100 hosts produces 76.8 Mbit/s of traffic at the victim — a hundredfold gain. He observed over 80 Mbit/s generated from roughly 400 kbit/s of input against a 200-host LAN.

That is the entire appeal of amplification: the attacker commits a small, cheap upstream and the intermediaries supply the volume. The same arithmetic, with larger factors, powers the UDP reflectors covered in the amplification attacks guide.

03Why smurf largely died

Smurf depended on networks forwarding and answering packets sent to their directed-broadcast address from outside. Remove that behaviour and the multiplier disappears.

RFC 2644, published in 1999 as BCP 34, changed the recommended router default: routers must not forward network directed broadcasts unless specifically configured to. Cisco disabled directed broadcasts by default from IOS 12.0 — the command reference states the default as "all IP directed broadcasts are dropped". Hosts also began ignoring broadcast echo requests by default, controlled on Linux by `net.ipv4.icmp_echo_ignore_broadcasts`, which ships enabled.

With both the router forwarding and the host replies off by default, the pool of usable smurf amplifiers collapsed. The attack is now mostly of historical interest — but only because of a deliberate, internet-wide default change, not because attackers lost interest in amplification.

• `no ip directed-broadcast` on routers — the default since Cisco IOS 12.0, codified by RFC 2644 / BCP 34
• Hosts ignore broadcast echo by default (`icmp_echo_ignore_broadcasts = 1` on Linux). To confirm on a Linux host, run `sysctl net.ipv4.icmp_echo_ignore_broadcasts`; it should print `= 1`, and a 0 means the host will answer broadcast pings and could act as an amplifier
• Ingress filtering (RFC 2827 / BCP 38) stops the spoofed source packets that make reflection possible in the first place
• The same defences blunt the fraggle UDP variant, which abuses the echo and chargen services instead of ICMP

04The fraggle variant

Fraggle is smurf with UDP instead of ICMP. Rather than echo requests it sends packets to the broadcast address aimed at the UDP echo service (port 7) or chargen (port 19), both of which generate a reply. The amplification logic is identical; only the protocol changes.

It died the same way, with the same fixes: disabling directed broadcasts removes the broadcast multiplier, and disabling the obsolete echo and chargen services on hosts removes the responders. Those services are relics almost nobody runs today, which is why fraggle is even rarer than smurf.

05How today's attacks inherited the idea

Smurf is gone but its blueprint is everywhere. Modern reflection attacks swapped broadcast domains for misconfigured, internet-facing UDP services — DNS resolvers, NTP servers, memcached, SSDP, CLDAP — that each turn a small spoofed request into a large reply aimed at the victim. The strongest of them amplify far more than a broadcast segment ever did: memcached has reached five figures.

The defences are also the direct descendants of the smurf fixes. Source-address validation (BCP 38) stops the spoofing that reflection needs; closing or restricting open reflectors removes the multipliers, exactly as disabling directed broadcasts did. The full catalogue of today's reflectors, with factors and worked sums, is in amplification attacks explained and the specific case of DNS amplification.

06Smurf attack timeline

Smurf faded from a live threat to a historical footnote within a few years, and the decisive steps were defaults being changed rather than clever filters. The dates below come from the CERT advisory, the IETF documents and the vendor reference cited at the end of this page.