COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-487

ICMP Flood

An adversary may execute a flooding attack using the ICMP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth. A typical attack involves a victim server receiving ICMP packets at a high rate from a wide range of source addresses. Additionally, due to the session-less nature of the ICMP protocol, the source of a packet is easily spoofed making it difficult to find the source of the attack.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary may execute a flooding attack using the ICMP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth. A typical attack involves a victim server receiving ICMP packets at a high rate from a wide range of source addresses. Additionally, due to the session-less nature of the ICMP protocol, the source of a packet is easily spoofed making it difficult to find the source of the attack.

Requirements

What does the attack require?

Prerequisites

  • This type of an attack requires the ability to generate a large amount of ICMP traffic to send to the target server.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Defence

How is it prevented and mitigated?

1
To mitigate this type of an attack, an organization can enable ingress filtering. Additionally modifications to BGP like black hole routing and sinkhole routing(RFC3882) help mitigate the spoofed source IP nature of these attacks.
CAPEC-487: ICMP Flood — DayBreach Saldırı Sözlüğü · DayBreach