I try to set up a test environment using Ubuntu VMs to generate IDS data for the Smurf attack. For that I need broadcast PING to work.
The setup is pretty simple. There is a victim network and an attacker network. Both are connected via a Ubuntu gateway to a repeater network containing Ubuntu VMs. In the attack scenario, a host from the attacker network floods the repeater network with broadcast PINGs and spoofs its IP address so all the Echo Replies are sent to a host in the victim network instead.
This attack is quite old and there seem to be numerous security measures implemented in Linux to prevent it. I already switched off the rp_filter in sysctl so I can do IP spoofing. I also switched off net.ipv4.icmp_echo_ignore_broadcasts on all Ubuntu machines, so the network reacts to broadcasts.
Here is my problem: If I broadcast PING the repeater network from the gateway, all its hosts answer as expected. However, if I send a broadcast PING (with
ping -b 184.108.40.206) from the attacker network, only the gateway answers. All the hosts in the repeater network remain silent. It seems to me as if the gateway does not forward the ICMP messages, but I cannot say why.
Are there any sysctl flags or iptables rules I can set to make ICMP broadcasts comming from other networks actually work?
Thanks in advance!