iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A ping of death is a denial-of-service attack that exploits a flaw in how a system handles an improperly oversized, often fragmented ICMP echo request. The classic attack could crash vulnerable systems during IPv4 packet reassembly; it was not an ordinary ping and did not depend on sending a flood of requests.
What does ping of death mean?
The term describes an attack in which malformed ICMP echo-request data is crafted so that its size or fragments exceed what the receiving implementation can safely handle. The target’s packet-processing or reassembly code has the flaw: ICMP echo requests themselves are a normal network diagnostic function.
The IETF’s RFC 4949 calls “ping of death” deprecated terminology and recommends describing the mechanism more specifically, such as a “ping packet overflow attack.”
How did the classic IPv4 attack work?
IPv4’s 16-bit Total Length field allows a datagram of at most 65,535 bytes, including its IP header. That is a limit on the entire IPv4 datagram, not a recommended ICMP payload size. The IETF discusses this limit in RFC 4732 (2006) and RFC 6274 (2011).
#1 Best Overall
When a datagram is too large for a network link’s MTU, it may be carried in IP fragments and reassembled by the destination. The historic attack sent fragments of a single ICMP echo request whose combined extent exceeded the IPv4 maximum. Vulnerable systems mishandled that condition and could crash or otherwise fail.
How is it different from a normal ping or ping flood?
| Traffic pattern | What distinguishes it | Potential effect |
|---|---|---|
| Ordinary ping | A valid ICMP echo request used to check whether a host responds. | Normally elicits an echo reply; it is not inherently an attack. |
| Ping of death | Malformed oversized packet data or fragments exploit a packet-handling or reassembly flaw. The historic IPv4 case involved one fragmented request. | May cause the vulnerable receiver to fail. |
| Ping flood | Many echo requests or excessive traffic are sent to consume network or system resources. | May overwhelm capacity through traffic volume rather than malformed reassembly. |
The distinction is the mechanism: the classic ping of death targeted a receiver’s handling of an invalid packet size, while a flood relies on the volume or rate of traffic.
When did the attack become known?
RFC 4732 says the exploit became widely known in 1996 and describes popular operating systems crashing after a single fragmented ICMP echo request whose fragments totaled more than the 65,535 bytes allowed in an IPv4 packet. The RFC points to CERT Advisory CA-1996-26, “Denial-of-Service Attack via ping,” dated December 1996.
How is the underlying flaw addressed?
Defenses focus on correctly validating packet lengths and safely handling IP fragmentation and reassembly, as well as maintaining patched network software. RFC 6274 discusses dropping packets that fail length-consistency checks, and RFC 4732 notes that affected code can be patched once a flaw is discovered.
The classic vulnerability is historic, but that history does not establish that every current system or device is immune. Exposure depends on the particular implementation; a claim about a current product requires evidence about that product.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
