When a firewall's CPU sits at 100 percent while its bandwidth graph still reads a trickle, a BlackNurse attack is a prime suspect. That gap between load and volume is exactly the kind of failure a thorough DDoS test is built to expose. BlackNurse floods a firewall with ICMP Type 3 Code 3 packets, the "destination unreachable, port unreachable" message, rather than the ICMP echo requests an ordinary ping flood uses. On some stateful firewalls that one message type is unusually expensive to process, so the device can be pushed over from a single home broadband connection while every volume-based dashboard stays green.
The expensive message
An ordinary ICMP flood sends echo requests, Type 8, and leans on sheer volume. BlackNurse sends Type 3 Code 3 instead, and the difference is not the volume but the handling. On the affected firewalls each of these packets triggers a full session lookup and stateful processing, as the device tries to correlate the "unreachable" message with an existing flow. That per-packet work is cheap for the attacker to generate and expensive for the firewall to perform, so the count of packets per second, not their bandwidth, is what does the damage.
The numbers are the striking part. The CPU on a vulnerable device saturates at rates as low as 15 to 18 Mbps, roughly 40,000 to 50,000 packets a second, a trickle by volumetric standards and well within a single residential uplink. A volumetric flood would need hundreds of gigabits to force the same firewall offline. The attack was documented in 2016 by the security operations team at the Danish operator TDC, which found the pattern reliably degraded several enterprise firewalls, Cisco ASA models prominent among them, while leaving the link almost idle.
The reason it hides is that the traffic profile stays small. A defense sized for packet volume or raw throughput sees nothing worth alerting on, because on a bandwidth graph the attack barely registers. Meanwhile the device behind that graph, the firewall itself, has stopped forwarding traffic, so the whole segment behind it goes dark while the numbers everyone watches look calm.
Why a small attack is not a safe one
BlackNurse breaks a comfortable assumption: that a small attack is a harmless one, and that a firewall rated for tens of gigabits can shrug off eighteen megabits. The rating describes the wire, not the cost of parsing a particular message, and those are different limits. A stateful firewall is exactly the wrong device to absorb this, because its job is to inspect and correlate every packet, which is precisely the work the attack makes expensive.
It also exposes a monitoring blind spot that outlives any one firmware fix. A team instrumented only for bandwidth will record a pass during a live BlackNurse event, because the resource that ran out, the firewall's processing budget, is not the resource it was watching. The lesson generalizes past this specific message: the smallest processing limit anywhere in the path, not the largest link, sets the real ceiling.
What a DDoS test measures
A test that only ramps bandwidth will report a clean result while a specific low-rate ICMP pattern still pegs the firewall, so the useful test drives the message itself. It measures the CPU load a stream of ICMP Type 3 Code 3 packets puts on the firewall at low bit rates, and finds the packet-per-second point where the device stops forwarding.
Then it confirms the mitigation without collateral damage. Dropping this message type at the edge or an upstream router is the standard fix, but it has to be done with care: other ICMP unreachable codes carry legitimate signaling, so a rule that blanket-blocks Type 3 can break path-MTU discovery and quietly damage normal connections. A good test verifies that filtering Code 3 specifically holds under load while legitimate ICMP still flows.
For where this sits among the network-layer classes, see Understanding DDoS Attack Vectors.