ICMPflodeja

ICMPflodeja refers to a class of denial-of-service techniques in which attackers generate large volumes of ICMP traffic to exhaust the resources of a target network or host. The term is used in security discussions to describe both direct ICMP floods and amplification-based variants, though it is not an official protocol designation.

Direct ICMP floods typically involve flooding a victim with ICMP Echo Request (ping) packets, or other ICMP types, from one or more sources. Amplification variants employ misconfigured intermediaries that reply with larger ICMP responses to a spoofed source address, increasing traffic toward the target without proportional investment by the attacker. Classic examples include ping floods and, in the past, amplified Echo Replies via misconfigured routers.

Attack traffic tends to be uniform in ICMP type and destination, producing sudden spikes in inbound bandwidth and CPU load on routers, firewalls, and servers. Detection often relies on traffic analytics showing abnormal ICMP rates, unusual source distribution, or sustained saturation of network links.

Mitigation combines defensive filtering and rate limiting at network edges, disabling or restricting ICMP types not required for operation, implementing ingress filtering (Source Address Validation), and employing DDoS protection services. Network operators may also tune device resources and apply anomaly-based detection to distinguish legitimate ICMP use from floods.

See also: ICMP, ping flood, DDoS, ICMP amplification attack.