7

I am using college network to access internet. Many other users are using the same network. Recently I have been experiencing sluggish net connection. So when I did some investigation, I found that many other computers on the network have been sending ICMP packets to me. I used Wireshark to analyse the incoming packets . Here is an screenshot of my my analysis:

ICMP packet

(My IP was 192.168.38.58)

The packet capture was filled with these ICMP request. When I searched the web about it then I found that there is an attack named smurf attack in which attacker force other system in the network to send ICMP request to victim system.

Is this an example of smurf attack? If so then how to prevent my computer from being Attacked.

Please provide solution for both linux and windows Operating system.

EDIT No. 1:------

When I changed the MAC address of my PC, everything got back to normal. No such malicious packets were observed.

EDIT No. 2:------

I had used Advanced Port Scanner to scan my active port.

The port which was sending UDP packet(53411) is closed

Improve this question
12
  • The answer to what happened is not in the screenshot. It may be in the capture file, so if you would share the full capture file, we might be able to find it. The interesting packets are earlier in the flow than what your screenshot shows.
    – kasperd
    Jun 17, 2015 at 16:01
  • 1
    Be careful using Wireshark and/or port scanners on a University network. As stupid as it is many Universities have rules against this.
    – Spaceman Spiff
    Jun 17, 2015 at 17:45
  • 1
    The reason when you changed your MAC address things went back to "normal" is because other computers were still using the old ARP entry. I'd suspect eventually once the ARP caches are cleared you'll see similar traffic again. The traffic you are seeing is normal for a university network and not indicative of an attack.
    – Herringbone Cat
    Jun 17, 2015 at 19:29
  • @SpacemanSpiff If you are running it on your own computer, then it is probably outside their jurisdiction anyways. After all Wireshark does not send any network traffic at all. It is simply a tool to display which traffic the network is already sending to that host.
    – kasperd
    Jun 17, 2015 at 20:04
  • 1
    @kasperd One would think, and I was completely surprised when I found out my University banned it, but here is an example (just ctrl-f wireshark) from a random University. Policies like this aren't uncommon at all.
    – Spaceman Spiff
    Jun 17, 2015 at 20:13

2 Answers 2

Reset to default
20

The ICMP packets coming back were in response to your host sending out UDP packets to other hosts who don't have port 2054 open. It was not a smurf of any sort, unless someone remotely compelled your PC to send out those packets. Regardless, it would take a lot more than a few dozen small packets on the local subnet to noticeably slow your connectivity. The culprit to your speed issue lies elsewhere. Also, try to find out why your PC is sending UDP packets to port 2054 on a large number of hosts.

Improve this answer
7
  • How is my PC compelled to send UDP packets to other hosts?
    – Snake Eyes
    Jun 17, 2015 at 13:16
  • 5
    Bittorrent would be my guess ¯\_(ツ)_/¯
    – Jeff Meden
    Jun 17, 2015 at 13:17
  • I am not using it. Any other guess?
    – Snake Eyes
    Jun 17, 2015 at 13:19
  • 4
    Sorry for the snark. Your PC is running something looking for open UDP port 2054 on other PCs on your subnet. If you arent intentionally running some sort of peer-to-peer software like Bittorrent then it is probably malicious and could be symptomatic of (but not the cause of) your speed issues. I would suggest taking a careful look at running processes, and other traffic.
    – Jeff Meden
    Jun 17, 2015 at 13:25
  • 4
    Try using netstat -o to find out which process is sending UDP 2054, then investigate that process
    – GdD
    Jun 17, 2015 at 13:48
4

Based on the screenshot and data you present, you are not on the receiving end of a smurf attack. This exploit is nostalgic for me -- back in the day, I used to hang out on IRC with TFreak and was playing with the smurf exploit when it was first created.

The smurf exploit simply would issue ICMP to a broadcast IP. Now, back in these days CIDR didn't really exist, so most networks were Class C (e.g. 8.8.8.x) or Class B (e.g. 8.8.x.x). In this exploit, pinging the broadcast IP of the network would send the ICMP packet to all the hosts in the subnet -- either up to 254 for the Class C, or up to 65535 in a Class B. The smurf exploit would spoof the ICMP packet so the ping would seem to come from the victim IP. Then, replies would flood in from all the active machines that received the spoofed packet via their broadcast IP. In such a way, one ping would be amplified up to 65,000x in replies, flooding the downstream of the victim IP.

This was the late-90s. These days, pretty much all networks are patched against this kind of exploit and there are few vulnerable broadcasts. A more modern incarnation is the DNS amplification attack, which recently was used for a large DDoS.

Also the IPs in the middle of your screenshot are all RFC1918 local IPs, so that traffic is within your LAN. Chances are there is not a smurf attack going on inside your network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .