Understand the amplification risk and its limits
05An attacker may lie about a packet’s source address. A network that accepts and forwards directed broadcasts can then turn one request into traffic from several responders toward the claimed source.
Separate reset to the required blocking default: the path stops before receipt and there is no LAN delivery or reply path in this example. Ingress filtering and other protections remain necessary.
Source for this drawing: RFC 2644 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
RFC 2644 §2 describes networks permitting externally originated directed broadcasts as potential Smurf amplifiers. This is a simplified hypothetical reflection example, not an attack generator.
- RFC 2644 §2 describes networks permitting externally originated directed broadcasts as potential Smurf amplifiers. This is a simplified hypothetical reflection example, not an attack generator.
- The permitted comparison assumes receive and forwarding enabled and two fictional hosts that choose to reply. Two drawn replies are an example, not a specified ratio or a host MUST; not every protocol or host responds.
- Default blocking prevents the depicted broadcast from entering the destination LAN. It does not authenticate source addresses or stop all denial-of-service attacks. Section 2 also urges ingress filtering, which checks traffic entering a network; this RFC does not define a complete ingress-filter algorithm.
- Section 4 states the goal is reducing the efficacy of certain denial-of-service attacks. The historical Mobile IP discussion in §2 is context, not a new requirement here to remove a feature or forbid every legitimate broadcast use.
Fictional documentation addresses and a last-hop router that knows the destination prefix. A bounded teaching illustration, not a router configuration or packet tool.
Read the RFC section ↗