Which type of DDoS attack uses spoofed ICMP echo requests sent to broadcast…

Concept

A reflection-and-amplification DDoS attack abuses a protocol that auto-replies to requests. The attacker forges the source IP of each request to be the victim's address and aims the request at many third-party hosts; every host then sends its reply to the spoofed source, so the victim is buried under traffic it never solicited. The defining ingredients are a spoofed (forged) source IP set to the victim, and a broadcast/many-host fan-out that multiplies one request into many replies.

Applying it here

The stem fixes three specific markers: the protocol is ICMP echo (ping); the requests are spoofed with the victim's source address; and they are sent to a broadcast address so every host on that subnet answers. Spoofed ICMP echo plus broadcast fan-out plus a flood of ICMP echo replies aimed at the victim is precisely the Smurf attack.

Contrast with the other techniques

• SYN Flood: exhausts a server's half-open TCP connection table with a flood of TCP SYN packets; it uses TCP, not ICMP, and involves no broadcast amplification.

• Ping of Death: sends a single malformed or oversized ICMP packet to crash the target via a reassembly bug; it is a malformed-packet exploit, not a broadcast-amplified reply flood.

• DNS Amplification: spoofs the victim's IP on small DNS queries to open resolvers so that large DNS responses hit the victim; it amplifies over UDP/DNS, not via ICMP echo to a broadcast address.

• UDP Flood: blasts UDP datagrams at random ports to force ICMP port-unreachable replies and saturate links; it is volumetric UDP, with no spoof-to-broadcast ICMP-echo mechanism.

Only one technique combines spoofed ICMP echo requests with broadcast fan-out: the Smurf attack.