Editing Smurf attack (section)

==Mitigation==
The fix is two-fold:
#Configure hosts and routers to ignore packets where the destination address is a broadcast address; and
#Configure routers to not forward packets directed to broadcast addresses. Until 1999, standards required routers to forward such packets by default. Since then, the default standard was changed to not forward such packets.{{Ref RFC|2644}}

It's also important for ISPs to implement [[ingress filtering]], which rejects the attacking packets on the basis of the forged source address.{{Ref RFC|2827}}

===Mitigation on a Cisco router===
An example of configuring a router so it will not forward packets to broadcast addresses, for a [[Cisco Systems|Cisco]] router, is:
:{{code|Router(config-if)# no ip directed-broadcast}}<ref>{{cite web|url=https://www.cisco.com/c/en/us/about/security-center/guide-ddos-defense.html|title=A Cisco Guide to Defending Against Distributed Denial of Service Attacks|website=Cisco|language=en|access-date=2019-09-26}}</ref>

(This example does not protect a network from becoming the ''target'' of a Smurf attack; it merely prevents the network from ''participating'' in a Smurf attack.)