On the Internet, ping of death is a
denial of service (DoS) attack caused by an attacker deliberately sending an
IP packet larger than the 65,536 bytes allowed by the IP
protocol. One of the features of TCP/IP is fragmentation; it allows a single IP
packet to be broken down into smaller segments. In 1996, attackers began to
take advantage of that feature when they found that a packet broken down into fragments could add up to more than the allowed 65,536 bytes. Many operating systems didn't know what to do when they received an oversized packet, so they froze, crashed, or rebooted.
Ping of death attacks were particularly nasty because the identity of the attacker sending the oversized packet could be easily spoofed and because the attacker
didn't need to know anything about the machine they were attacking except for its IP address. By the end of 1997, operating
system vendors had made patches available to avoid the ping of death. Still, many Web sites continue to block Internet
Control Message Protocol (ICMP) ping messages at their firewalls to prevent any future variations of this kind of denial of service attack.
Ping of death is also known as "long ICMP."
This was last updated in May 2002
Dig Deeper
-
Adobe Reader X uses Microsoft's sandboxing technology to block potentially dangerous processes from executing beyond the confines of the software.
-
Microsoft repaired four vulnerabilities in its Forefront Unified Access Gateway and a critical flaw in Microsoft Office.
-
Download the entire October 2010 issue of Information Security magazine here in PDF format.
-
People who read this also read...
-
Resources from around the Web