“Image 2: ICMP type 8, Additional Information”Īnalysis of ICMP (Type 8) Flood in Wireshark – Filters: “Image 1: The IP of the attacker and the victim”Īs shown in Image 2 the packet is an ICMP type 8 packet (Echo request). These packets have a source IP (which is normally spoofed to reduce the effect of IP reputation mechanisms) and the destination IP of the victim.

Technical AnalysisĪs seen in the Image 1 an ICMP Flood of type 8 consists of a high volume of ICMP Echo packets. Generally this flood is used as a basic but effective flood to bring down perimeter devices or saturate bandwidth. ICMP Floods, if not dropped by DDoS mitigation devices on the perimeter, may overwhelm the internal network architecture this flood may also generate outgoing traffic due to answers for the echo request. ICMP Floods are generally spoofed attacks and normally come at a very high rate, they are effectively echo requests, that may illicit echo responses (ICMP Type 0).

ICMP Floods are DDoS attacks aimed at consuming computing power and saturating bandwidth.

Ping pcap wireshark grand canyon