but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target. We were more sophisticated back then. So

but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target. We were more sophisticated back then. So picture your netblock is 207.180.10.0/24 and you've directly connected all 200 computers on your Class-C netblock directly to the public Internet without any NAT. 207.180.10.0 is your network ID and 207.180.10.255 is your broadcast address. Someone comes along and sends a 64 byte ICMP ECHO request to 207.180.10.255. And they get 200 responses. Literally every one of the computers on your entire network responds with an ICMP ECHO reply. So now they can spoof an IP address from Victim IP address to send 1k ICMP ECHO requests to 207.180.10.255 and multiply their attack 200:1. But now imagine instead of a tiny Class-C netblock they find a similarly configured broadcast address for a huge Class-A netblock. And their scanner counts 29,000 ICMP ECHO replies for each request they send out. Now their attack is multiplied 29,000:1. And since they've been scanning for broadcast addresses on the public Internet every day for a month they have compiled a list of hundreds of them so the attack seems to be coming from everywhere. https://www.fortinet.com/resources/cyberglossary/smurf-attack https://www.fortinet.com/resources/cyberglossary/smurf-attac...