https://netacoding.com/tags/wire-level-evidence/ Recent content in Wire-Level-Evidence on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Mon, 01 Jun 2026 00:00:00 +0000 https://netacoding.com/posts/smurf-reflection/ Mon, 01 Jun 2026 00:00:00 +0000 https://netacoding.com/posts/smurf-reflection/ ArubaOS 8.13.2.0 accepts ICMP Echo Requests with spoofed source IPs (no uRPF/BCP38) and replies to broadcast source addresses — enabling Smurf amplification from L2 adjacency. Two independent pcap captures (attacker + victim) confirm unsolicited Echo Reply to a host that sent zero ICMP requests. RFC 1122 §3.2.2.6 violation. Submitted Bugcrowd, closed as expected behavior.