Smurf Amplification in 2026: Pre-Auth ICMP Reflection via L2 Broadcast | CVE-1999-0513 & Enterprise VLAN
Smurf amplification requires three weaknesses simultaneously: no uRPF allows IP source spoofing, directed broadcast forwarding delivers the packet to all VLAN hosts, hosts reply to broadcast ICMP Echo. RFC 2644 fixed router-level directed broadcast. L2 broadcast domains are unaffected — the packet never crosses a router. Enterprise wireless VLANs with 50-100 APs and controllers become 50-100x amplifiers. ICMP processing is pre-authentication: no credentials, no session. Two-machine verification: attacker sends spoofed src=victim to broadcast, victim captures unsolicited Echo Replies. pcap-level proof included.
