User`s guide

ZyWALL IDP 10 User’s Guide
Appendix A Introduction to Intrusions 110
Figure 63 SYN Flood
LAND Attack
In a LAND attack, hackers flood SYN packets into the network with a spoofed source IP
address of the targeted system. This makes it appear as if the host computer sent the packets to
itself, making the system unavailable while the target system tries to respond to itself.
Smurf Attack
A Smurf attack targets a feature in the IP specification known as directed or subnet
broadcasting, to quickly flood the target network with useless data. A Smurf hacker floods a
router with Internet Control Message Protocol (ICMP) echo request packets (pings). Since the
destination IP address of each packet is the broadcast address of the network, the router will
broadcast the ICMP echo request packet to all hosts on the network. If there are numerous
hosts, this will create a large amount of ICMP echo request and response traffic. If a hacker
chooses to spoof the source IP address of the ICMP echo request packet, the resulting ICMP
traffic will not only clog up the "intermediary" network, but will also congest the network of
the spoofed source IP address, known as the "victim" network. This flood of broadcast traffic
consumes all available bandwidth, making communications impossible.