# PrECast: An Efficient Crypto-Free Solution for Broadcast-Based Attacks in IPv4 Networks
## 2 Taxonomy of Broadcast-Related Problems in IPv4 Networks
### Attacks from An External Network  
The main objective for this class of attack is to launch a DoS attack against the target network [3]. The attacker may not be interested in obtaining any valuable information from the target network. The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating, for example, that a requested service is not available or that a host or router could not be reached [1]. The Smurf IP DoS attack [4] is a classical example of a DoS attack that exploits the IP broadcast mechanism using ICMP-echo messages. Smurf attack uses a ICMP-echo request with a large payload towards the victim. There are three parties involved in this attack: the attacker, the intermediary and the victim. The intermediary is not a single host, rather all active hosts in a specific IP subnet. One of the criteria for being an intermediary network is that it must have higher upstream bandwidth than the victim's downstream traffic. It also must have a large number of active hosts in the network. To launch this attack, the attacker first needs to create a forged ICMP-echo-request packet with the victim's IP address as the source address and the IP broadcast address of the intermediary network as the destination address. This echo-request will be received by every active host in the intermediary network. They in turn send an ICMP-reply to the victim's machine. In this case, a single forged ICMP-echo-request from the attacker will result in hundreds of ICMP-echo-replies targeted towards the victim. Thus, the victim is subjected to network congestion that could potentially make the network unusable. If the intermediary network has less upstream bandwidth, this attack will also introduce network congestion in the intermediary network. A Fraggle attack [4] is a variation of a Smurf attack where an attacker sends a large mount of spoofed random UDP traffic to ports 7 (Echo) and 19 (Chargen) to an IP broadcast address, with the intended victim's spoofed source IP address. It works very similarly to the Smurf attack in that many computers on the network will respond to this traffic by sending traffic back to the spoofed source IP of the victim, flooding it with traffic. Modern routers by default do not forward IP broadcast packets. Thus, most current networks are immune to Smurf and Fraggle attacks. An attack that is similar to Smurf and Fraggle attacks is the DNS amplification attack [5; 6; 7]. Through various techniques, the attacker turns a small DNS query into a much larger payload directed at the target network. The attacker sends a DNS look-up request using the spoofed IP address of the victim to vulnerable DNS servers that support the open recursive relay. The original request is often relayed through botnets for a larger base of attack and further concealment. These amplifications can increase the size of the requests from around 40 bytes to 4000 bytes, which is well above the maximum Ethernet packet size. The packets that are larger than the path MTU (Maximum Transmission Unit) need to be broken down for transmission and then reassembled at the destination host. This will consume more of the victim's network resources. Like the Smurf attack, botnets [8] may furthermore be used to increase the amplitude of this attack. The attack is hard to protect against using firewalls, as it comes from valid-looking servers with valid-looking traffic. According to Arbor's report [9], the average size of DNS reflection amplification attacks is growing greatly. The maximum observed data rate of the DNS reflection amplification attack size in first half of 2016 was 480 Gbps. According to them, DDoS remains a commonly-used attack type due to the ready availability of free tools and inexpensive online services that allow anyone with a grievance and an Internet connection to launch an attack. This has led to an increase in the frequency, size and complexity of attacks in recent years.