Hunting

Statistics → Endpoints → IPv4 Statistics → Conversations → ICMP Statistics → Protocol Hierarchy

Goal

• Attacker spoofs victim IP
• Sends ICMP Echo Request to broadcast address
• Many hosts reply to victim Victim gets flooded with ICMP replies.

Red Flags

• Large volume of ICMP Echo Replies
• Same destination IP
• Many different source IPs
• Possibly broadcast destination used in request

Filters

# ICMP Echo Requests  
icmp.type == 8

# Echo replies to victim
icmp.type == 0 && ip.dst == VICTIM_IP

# Broadcast destination  
ip.dst == 255.255.255.255 or eth.dst == ff:ff:ff:ff:ff:ff

# Volume detection
icmp