Ping flood

A ping flood is a simple denial-of-service attack where the attacker overwhelms the victim with ICMP Echo Request (ping) packets. It only succeeds if the attacker has more bandwidth than the victim (for instance an attacker with a DSL line and the victim on a dial-up modem). The attacker hopes that the victim will respond with ICMP Echo Reply packets, thus consuming outgoing bandwidth as well as incoming server bandwidth.

Defense

To reduce the effects of a ping flood, a victim can use a firewall to filter the incoming ICMP Echo Request packets entirely, or if a large number of requests are received at one time. Refusing to send ICMP Echo Reply packets produces two benefits:
#Less bandwidth is wasted by not answering these packets.
#It is more difficult for the attacker to measure the effectiveness of the attack.

However, such a filter will also prevent the measuring of latency from legitimate users which may be undesirable. A compromise solution may be to only filter large ICMP Echo Request packets, or to limit the rate at which your firewall will pass ICMP Echo Request packets.

Note that one cannot trust the source IP address to be the address of which the packets are originating from since it can be spoofed to make it appear as if it is coming from another address. Packets can also be spoofed to contain a randomly generated address.

Other Information

An example ping flood batch file:

ping -f www. [example] .com

See also

*Denial-of-service attack
*Ping
*Ping of death
*Smurf attack