What is a Smurf attack; what do the Smurf rules in TR7 limit?

Short answer

In a Smurf attack, the attacker writes the victim's address as the source and sends an ICMP echo request (ping) to the broadcast address of a network; all the devices on the network send the reply to the victim, and a single packet turns into a large number of replies (RFC 2644). In TR7, on the L4 DDoS Management screen of the route table, there are two rules in the Smurf box in the ICMP & Reflection band, and neither of them looks at the broadcast address: ICMP Smurf: Pkt Limit limits the number of ICMP echo requests per second per source (default 100/s, default mode Monitor; in the Block and Quarantine modes, on IPv4, it additionally drops the address mask request, timestamp request and router solicitation types); Smurf: TCP Reset Limit, on the other hand, puts a common per-second ceiling per IP version on TCP RST packets that have no session (default 20/s, default value Disabled).

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → ICMP & Reflection → Smurf box	ICMP Smurf: Pkt Limit: Status (Disabled · Monitor · Block · Quarantine), Limit per Second	Monitoring or limiting the ICMP echo request rate per source
The same box	Smurf: TCP Reset Limit: Status (Enabled · Disabled), Limit per Second	A common ceiling on TCP RST packets that have no session
Route table Dashboard	The measurement panels of the rules (measurement and dashboard)	Monitoring the ICMP and RST volume

• Whether ICMP passes or not is determined in the ICMP box in the same band; reflected UDP replies, on the other hand, are the job of the Reflection & Amplification box: What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?
• The change is applied as soon as it is saved with Save; the rules are set separately for each route table.

Common Misconceptions

• "The Smurf rules catch pings sent to broadcast." Neither rule looks at the broadcast address: the ICMP rule limits the echo request rate per source whatever the target is, and the RST rule limits the rate of sessionless RSTs coming to the device.
• "The Smurf rules block by default." The default mode of the ICMP rule is Monitor, and the default value of the RST rule is Disabled; in Monitor mode, traffic is only measured and is not dropped.
• "TCP reset limit measures each source separately." The ceiling is common not per source but per IP version; the packets that exceed the ceiling are not accepted by this rule and are left to the subsequent rules.
• "The ICMP rule limits all ICMP types." The rate limit is applied only to the echo request type; in Block and Quarantine modes, the address mask request, timestamp request and router solicitation types are also dropped in IPv4. Whether the other types pass depends on the permission in the ICMP box.

How it is done in the documentation

• Smurf · What Is Smurf?
• Smurf · ICMP Smurf: Pkt Limit
• Smurf · Smurf: TCP Reset Limit
• Smurf · Scope and Limits

Related questions

• What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?
• What is spoofing; what do the Spoofing, LAND / Self-Spoof and Martians settings in TR7 catch?
• What is a DDoS attack; at which layers does TR7 provide DDoS protection?