What is a smurf attack and how do you block it?

A smurf attack is a denial of service attack that abuses a network's broadcast address. The attacker sends a request with the victim's address forged as the sender, and every host on the amplifying network replies to the victim. Disabling directed broadcasts and filtering forged source addresses closes it.

How does a smurf attack work?

The attack needs three ingredients: an ICMP echo request, a broadcast address, and a forged source.

1. The attacker crafts an ICMP echo request, a ping.
2. The destination is the broadcast address of a remote network, so in principle every host on that network receives it.
3. The source address is forged to be the victim's address.
4. Each host that answers sends its echo reply to the victim, not the attacker.

One small request becomes many replies. The network that relays the traffic is the amplifier. The attacker never sends traffic that points back to themselves.

What did the standards bodies say?

Two Internet Best Current Practice documents address the two enabling conditions.

RFC 2644 (August 1999), Changing the Default for Directed Broadcasts in Routers, notes that a recent trend in smurf attacks was to target networks that permit directed broadcasts from outside, which makes those systems smurf amplifiers. It observed that on the Internet backbone, directed broadcasts appeared to be used entirely for malicious attacks, and changed the router requirement: a router may have a configuration option to receive directed broadcast packets, but that option must be disabled by default.

RFC 2827 describes ingress filtering to prohibit denial of service attacks that use forged IP source addresses from propagating from behind an ISP's aggregation point. RFC 2644 itself says continued implementation of ingress filters remains the best way to limit these attacks, with restricting directed broadcasts also a priority.

So the guidance has two parts: do not be an amplifier, and do not let your network be a source of forged traffic.

Is this still a live problem?

RFC 2644 asked vendors to ship routers with directed broadcast forwarding disabled by default, but you should confirm the setting on your own devices, especially older ones. The pattern lives on in other amplification attacks that abuse a service that answers small requests with large replies to a forged address. The reasoning is the same: unauthenticated requests plus spoofable sources plus bigger replies.

A constructed example

A small company runs a legacy branch router that still forwards directed broadcasts from outside. A scan finds it, and an attacker sends forged pings to the branch's broadcast address with a victim's address as source. Forty office printers, laptops and phones each reply. The victim sees a stream of echo replies from a network they have never heard of, and the company sees its uplink fill while its own staff cannot work. Turning off directed broadcast on the router, a one-line configuration change, removes the company from the attack path.

How to check or apply this

1. Check every router and layer 3 device for directed broadcast forwarding and disable it. Test from outside the network.
2. Apply ingress filtering at your edge, so packets leaving your network carry only source addresses you own.
3. At the boundary, allow only the ICMP types you need and rate limit the rest.
4. Watch for a spike of echo replies to a host that did not send requests. That is the victim's view of this attack.
5. Agree with your upstream provider how to ask for filtering when you are the target.
6. Include legacy devices in your inventory, since old defaults are where this hides.

How can you tell if you are the victim or the amplifier?

The two cases look different. As the victim you see a flood of ICMP echo replies from many addresses that you never pinged, and your link saturates. As the amplifier you see your own hosts answering a request that came from outside, and your outbound traffic spikes toward a single remote address. In both cases packet captures at the edge show the pattern within minutes.

Document who you will call. The victim needs the upstream provider to filter. The amplifier needs only to switch off a setting, but should also check whether other devices have the same default.

Quick check

Sources

• RFC 2644, Changing the Default for Directed Broadcasts in Routers, fetched 18 October 2026.
• RFC 2827, Network Ingress Filtering, fetched 18 October 2026.

Last reviewed: 18 October 2026.