Smurf Attack: ICMP Broadcast Amplification
A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?
Quick Answer
The correct answer is a Smurf attack. This DDoS technique exploits ICMP broadcast amplification by sending a large number of ICMP echo request packets with a spoofed source IP address—the victim’s—to a network’s broadcast address, causing every host on that network to reply simultaneously to the victim, thereby overwhelming it with traffic. On the Certified Ethical Hacker CEH exam, this question tests your understanding of network-layer amplification attacks and the misuse of broadcast addressing; a common trap is confusing it with a ping flood, which targets a single host directly rather than leveraging broadcast amplification. Remember the mnemonic “Smurf sends spoofed ICMP to the broadcast, and the whole subnet smothers the victim.”
⚠ Common exam trap
The trap is confusing a Smurf attack with a simple ICMP flood or Ping of Death, which do not involve the broadcast amplification mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
A Smurf attack exploits IP broadcast addressing and ICMP echo requests. The attacker sends ICMP echo request packets with a spoofed source IP (the victim's IP) to the network's broadcast address, causing every host on that network to reply to the victim, overwhelming it with ICMP echo replies. This amplification effect makes the attack highly effective, as a single request generates many responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDP flood
Why it's wrong here
UDP flood uses UDP packets, not ICMP.
- ✗
SYN flood
Why it's wrong here
SYN flood uses TCP SYN packets, not ICMP.
- ✓
Smurf attack
Why this is correct
Smurf uses ICMP echo requests to broadcast address with spoofed source, causing amplification.
- ✗
Ping of Death
Why it's wrong here
Ping of Death sends oversized ICMP packets to crash the target, not amplification via broadcast.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst reviews logs and notices that an attacker crafted a packet with a source IP address matching the target's IP address, and sent it to a network's broadcast address. Which type of attack does this describe?
medium- A.UDP flood
- B.Ping of Death
- ✓ C.Smurf attack
- D.SYN flood
Why C: The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets. The attacker spoofs the source IP address to be the target's IP and sends these packets to a network's broadcast address. All hosts on that network then reply to the target, overwhelming it with ICMP echo replies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.