CyberGlossary

Attacks & Threats

Ping of Death

Also known as: PoD

Definition

A legacy denial-of-service attack that sends malformed or oversized ICMP echo packets, causing vulnerable TCP/IP stacks to crash, hang, or reboot when reassembling them.

Ping of Death exploits flaws in how older IPv4 stacks reassemble fragmented packets larger than the legal IP maximum of 65,535 bytes. By crafting a sequence of fragments whose reassembled length exceeds that limit, an attacker can trigger buffer overflows or kernel panics on unpatched systems such as 1990s Windows, classic macOS, certain Unix variants, and embedded devices. Modern operating systems and network stacks have long since fixed the underlying bugs, so the original Ping of Death is mostly historical, but conceptually similar oversized- or malformed-packet attacks resurface against new stacks (including IPv6 and IoT firmware). Defences include keeping stacks patched, perimeter filtering of malformed ICMP/IPv6 fragments, and fuzz-testing network components.

Examples

  • Sending fragmented ICMP echo requests that reassemble to over 65,535 bytes to crash an unpatched Windows 95 host.
  • Modern variants targeting IPv6 fragment reassembly in older embedded TCP/IP stacks.

Related terms