AT23: ICMP Flood
Definition
A victim server receives spoofed ICMP packets at a very high packet rate and with a very large source IP range. The victim server is overwhelmed by the large number of incoming ICMP packets. The attack consumes network resources and available bandwidth, exhausting the network until it shuts down. A full communication handshake is not used in the ICMP software stack to exchange data, making ICMP-based attacks difficult to detect. ICMP floods can overwhelm a network with packets containing randomized or fixed Source IP addresses. ICMP floods can target a specific server by using the victim’s information as the Destination port and IP within the packets.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | -- | Very Large | Very High | Variable | Not Valid | -- | -- | -- | -- |
Defense Fundamentals
The method to generate a Spoofed IP ICMP Flood is very similar to a Spoofed IP UDP Flood; Therefore, we have implemented near identical algorithms for ICMP and UDP floods:
-
Detection can be done by the source IP distribution,
-
This IP source distribution randomness is adjusted by the Filter Sensitivity Level.
-
While source IP distribution alone is effective, it lacks the 99+% accuracy of similar TCP filters. The IP filter can usually achieve 85-95% effectiveness, but this can be improved with the payload randomness tester as well.
-
In an ICMP flood, the payload tends to have very low entropy (same payload from the same bot) or extremely high entropy. These two extremes are taken into account in the Filter Sensitivity Level.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Filter sensitivity | Level 5 (1-10) | This feature allows the user to adjust the sensitivity level of the filter based on payload entropy. The recommended default setting is level 5. At this setting, it covers the following scenarios: a) All bots use the same payload b) Each bot uses a single payload, but it differs between bots c) All bots use random payloads. Increasing the sensitivity can cause false positives. Conversely, reducing the sensitivity might allow more attack packets through. |
| Show Advanced Controls | Disabled | Enabling this control opens up all of the controls for AT23. By default, the controls below will populate at their settings for the currently set filter sensitivity level. The advanced controls require careful configuration in order to work correctly. They should only be adjusted after direct consultation with RioRey. |
| Gate 1 Packet Threshold | ||
| Gate 2 Packet Threshold | ||
| Attack Packet Threshold | ||
| Attack Packet Percentage Threshold | ||
| Detection Sample Periods Min. | ||
| Non-spoofed Attack Detection Threshold | ||
| Random IP Attack Bucket Count Min. | ||
| Random IP Attack Bucket Value Max. | ||
| Packets Tested Per Sample Period |