What is a smurf attack?

The general mechanism is on amplification attacks.

1. The attacker forges the victim's address. As the source of ping requests; see IP spoofing.
2. It sends them to a broadcast address. The address that reaches every host on a network segment.
3. A router forwards the directed broadcast. Into the segment, where every host receives the ping.
4. Every host replies to the victim. One request becomes as many replies as there are hosts.

With many such networks used at once, a modest stream of requests became a flood large enough to fill the victim's link.

A fraggle attack sends UDP packets to a broadcast address, aimed at simple services such as echo and character generation, which answer every packet. The replies, again, go to the forged source.

Those services were common on hosts in the 1990s and are rarely enabled today, which removed most of the amplifiers even before routers changed.

Both end with the victim receiving a flood of ICMP traffic, and they differ in where it comes from. In a ping flood the attacker sends the packets directly, so the flood is only as large as the attacker's own bandwidth, or the botnet's.

In a smurf attack the attacker sends requests to other networks and lets their hosts send the replies. The flood is the attacker's traffic multiplied by the number of hosts that answer, and the victim sees it coming from those networks rather than from the attacker. That multiplication is what makes it a reflection attack and not a direct one.

The victim receives a flood of ICMP echo replies, answers to pings it never sent, from many hosts on a handful of networks. The replies arrive in bursts, one per host for each request the attacker sends to the broadcast address.

Because the sources are the amplifying networks rather than the attacker, blocking them by address stops the flood only if there are few of them. Contacting their operators to switch off directed broadcasts was the standard response at the time, and it worked network by network.

The decisive fix was a default. RFC 2644, published as BCP 34 in 1999, says routers should not forward directed broadcasts unless configured to. Once vendors changed their defaults, most networks stopped being amplifiers without anyone doing anything.

The other half is source address validation (BCP 38), which stops networks from sending packets with forged sources in the first place. It applies to every reflection attack, not only smurf.

As an attack, rarely. Networks that still forward directed broadcasts are uncommon, and many hosts no longer answer broadcast pings.

As a lesson, yes. The same pattern, a forged source and something that multiplies replies, moved to services such as NTP and memcached. Check that your own routers do not forward directed broadcasts and that your hosts do not answer pings to broadcast addresses.

Two settings decide it. On routers, directed broadcasts must not be forwarded from outside; this is the default on current equipment, and worth confirming on anything old or inherited. On hosts, replies to pings sent to a broadcast address should be switched off; most current operating systems already ignore them.

To test from outside, send a single ping to the broadcast address of your public range from a network you control and count the replies. One reply or none is the right answer. Many replies from different hosts mean the network could still be used against someone else.