ZyXEL Communications P-312 User Manual
P312 Broadband Security Gateway
Introducing the Prestige Firewall
14-3
ICMP Echo
A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as directed or
subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker floods a router
with Internet Control Message Protocol (ICMP) echo request packets (pings). Since the destination IP
address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo
request packet to all hosts on the network. If there are numerous hosts, this will create a large amount of
ICMP echo request and response traffic. If a hacker chooses to spoof the source IP address of the ICMP
echo request packet, the resulting ICMP traffic will not only clog up the "intermediary" network, but will
also congest the network of the spoofed source IP address, known as the "victim" network. This flood of
broadcast traffic consumes all available bandwidth, making communications impossible.
subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker floods a router
with Internet Control Message Protocol (ICMP) echo request packets (pings). Since the destination IP
address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo
request packet to all hosts on the network. If there are numerous hosts, this will create a large amount of
ICMP echo request and response traffic. If a hacker chooses to spoof the source IP address of the ICMP
echo request packet, the resulting ICMP traffic will not only clog up the "intermediary" network, but will
also congest the network of the spoofed source IP address, known as the "victim" network. This flood of
broadcast traffic consumes all available bandwidth, making communications impossible.
ICMP Vulnerability
ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert:
Table 14-1
ICMP Commands That Trigger Alerts
5
REDIRECT
13
TIMESTAMP_REQUEST
14
TIMESTAMP_REPLY
17
ADDRESS_MASK_REQUEST
18
ADDRESS_MASK_REPLY
Illegal Commands (NetBIOS and SMTP)
The only legal NetBIOS commands are the following - all others are illegal.
Table 14-2
Legal NetBIOS Commands
MESSAGE
REQUEST:
POSITIVE:
NEGATIVE:
RETARGET:
KEEPALIVE
All SMTP commands are illegal except for those displayed in the following tables.
Table 14-3
Legal SMTP Commands
DATA
EHLO
EXPN
HELO
HELP
MAIL
NOOP
QUIT
RCPT
RSET
SAML
SEND
SOML
TURN
VRFY