7

I am using college network to access internet. Many other users are using the same network. Recently I have been experiencing sluggish net connection. So when I did some investigation, I found that many other computers on the network have been sending ICMP packets to me. I used Wireshark to analyse the incoming packets . Here is an screenshot of my my analysis:

ICMP packet

(My IP was 192.168.38.58)

The packet capture was filled with these ICMP request. When I searched the web about it then I found that there is an attack named smurf attack in which attacker force other system in the network to send ICMP request to victim system.

Is this an example of smurf attack? If so then how to prevent my computer from being Attacked.

Please provide solution for both linux and windows Operating system.

EDIT No. 1:------

When I changed the MAC address of my PC, everything got back to normal. No such malicious packets were observed.

EDIT No. 2:------

I had used Advanced Port Scanner to scan my active port.

The port which was sending UDP packet(53411) is closed

  • The answer to what happened is not in the screenshot. It may be in the capture file, so if you would share the full capture file, we might be able to find it. The interesting packets are earlier in the flow than what your screenshot shows. – kasperd Jun 17 '15 at 16:01
  • 1
    Be careful using Wireshark and/or port scanners on a University network. As stupid as it is many Universities have rules against this. – Spaceman Spiff Jun 17 '15 at 17:45
  • 1
    The reason when you changed your MAC address things went back to "normal" is because other computers were still using the old ARP entry. I'd suspect eventually once the ARP caches are cleared you'll see similar traffic again. The traffic you are seeing is normal for a university network and not indicative of an attack. – Herringbone Cat Jun 17 '15 at 19:29
  • @SpacemanSpiff If you are running it on your own computer, then it is probably outside their jurisdiction anyways. After all Wireshark does not send any network traffic at all. It is simply a tool to display which traffic the network is already sending to that host. – kasperd Jun 17 '15 at 20:04
  • 1
    @kasperd One would think, and I was completely surprised when I found out my University banned it, but here is an example (just ctrl-f wireshark) from a random University. Policies like this aren't uncommon at all. – Spaceman Spiff Jun 17 '15 at 20:13
19

The ICMP packets coming back were in response to your host sending out UDP packets to other hosts who don't have port 2054 open. It was not a smurf of any sort, unless someone remotely compelled your PC to send out those packets. Regardless, it would take a lot more than a few dozen small packets on the local subnet to noticeably slow your connectivity. The culprit to your speed issue lies elsewhere. Also, try to find out why your PC is sending UDP packets to port 2054 on a large number of hosts.

  • How is my PC compelled to send UDP packets to other hosts? – Snake Eyes Jun 17 '15 at 13:16
  • 4
    Bittorrent would be my guess ¯\_(ツ)_/¯ – Jeff Meden Jun 17 '15 at 13:17
  • I am not using it. Any other guess? – Snake Eyes Jun 17 '15 at 13:19
  • 4
    Sorry for the snark. Your PC is running something looking for open UDP port 2054 on other PCs on your subnet. If you arent intentionally running some sort of peer-to-peer software like Bittorrent then it is probably malicious and could be symptomatic of (but not the cause of) your speed issues. I would suggest taking a careful look at running processes, and other traffic. – Jeff Meden Jun 17 '15 at 13:25
  • 4
    Try using netstat -o to find out which process is sending UDP 2054, then investigate that process – GdD Jun 17 '15 at 13:48
3

Based on the screenshot and data you present, you are not on the receiving end of a smurf attack. This exploit is nostalgic for me -- back in the day, I used to hang out on IRC with TFreak and was playing with the smurf exploit when it was first created.

The smurf exploit simply would issue ICMP to a broadcast IP. Now, back in these days CIDR didn't really exist, so most networks were Class C (e.g. 8.8.8.x) or Class B (e.g. 8.8.x.x). In this exploit, pinging the broadcast IP of the network would send the ICMP packet to all the hosts in the subnet -- either up to 254 for the Class C, or up to 65535 in a Class B. The smurf exploit would spoof the ICMP packet so the ping would seem to come from the victim IP. Then, replies would flood in from all the active machines that received the spoofed packet via their broadcast IP. In such a way, one ping would be amplified up to 65,000x in replies, flooding the downstream of the victim IP.

This was the late-90s. These days, pretty much all networks are patched against this kind of exploit and there are few vulnerable broadcasts. A more modern incarnation is the DNS amplification attack, which recently was used for a large DDoS.

Also the IPs in the middle of your screenshot are all RFC1918 local IPs, so that traffic is within your LAN. Chances are there is not a smurf attack going on inside your network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.