Mastering Proxmox - Third Edition

The SMURFS filter

By default, the SMURFS filter is Enabled. By nature, Smurf is a distributed denial-of-service (DDoS) attack. In this attack, an attacker sends a very large number of ICMP data packets with the victim's spoofed IP address as the source, and it is broadcast to a network using the broadcast address. Generally, all network devices answer an ICMP ping. During a Smurf attack, the victim's device gets flooded by ICMP responses. If there are a large number of devices on the network, then the flooding becomes extreme, making the victimized device unresponsive. This is why this filter should remain enabled at all times.