Question

(c) Ping Flooding Attack

While no longer a practical DDoS attack, a Ping flooding attack demonstrates many features of DDoS attacks today. Provide a technical description of how a Ping flooding attack occurs. You must include a diagram illustrating an attack scenario (the diagram may be a modification of that used in the previous section), and provide a written explanation of the attack. You are expected to refer to the protocols used, steps of a successful attack, entities involved, and what resources are targeted.

Answer 1

Ping flood, also known as ICMP flood.
An attacker takes down a victim’s computer by oversend ICMP echo requests, also called as pings.
Because of flood attack target become inaccessible to normal traffic.

How does a Ping flood attack work?

Normally, ping requests are used to test the connectivity between devices.
During an attack, they are used to overload a target network with data packets.

An ICMP request requires some resources to process each request and to send a response.
The request also requires bandwidth on both the incoming message (echo-request) and outgoing response (echo-reply) used in ICMP.
The Ping Flood attack aims to overload the targeted device’s ability to respond to the high number of requests and overload the network connection with bogus traffic.

Ping Flood attack can be work into 2 steps:
1. sends many ICMP echo request packets to the targeted machine using multiple devices
2. The targeted server sends an ICMP echo reply packet to each requesting device as a response.