A Fraggle attack works by pointing a network's directed-broadcast address at its legacy UDP diagnostic services, rather than at the ICMP echo that a smurf attack abuses. It is a Layer 4 reflection vector, one of the volumetric classes a thorough DDoS test is built to exercise, and it produces its flood the way every reflection attack does: forge the victim as the source, and let innocent third parties send the traffic.
Fraggle's twist is which amplifier it reaches for. Smurf reflects off ICMP; Fraggle reflects off the UDP echo and chargen services sitting on a subnet's broadcast address.
Echo and chargen on a broadcast
The broadcast-reflection half of this is exactly what smurf does and is covered there: a spoofed source, a datagram to the directed-broadcast address, and every host on the segment answering the forged victim. Fraggle's difference is the two services it aims at and what they hand back.
UDP echo (port 7) returns a copy of whatever it received, so its gain is purely the number of listening hosts. Chargen (port 19) is the more dangerous half: asked for anything at all, it answers with a run of characters, so each reply is larger than the datagram that triggered it. A Fraggle pointed at chargen multiplies twice over, once by the host count of the broadcast and again by the per-reply expansion, which is the size element that the ICMP-only smurf never had.
The lineage is literal. The fraggle.c tool was released in 1998 by TFreak, the same author who had published smurf.c earlier that year, and the two are twins by design. The names are a pair of 1980s cartoon references, which is why the family reads as a joke until you meet the traffic.
Why it is mostly historical
Both the amplifier and the service have to be present, and modern defaults strip out each. RFC 2644 flipped the router default so a datagram aimed at a subnet's broadcast is no longer relayed, and Cisco IOS has shipped no ip directed-broadcast since release 12.0. The echo and chargen services, once enabled through inetd on old Unix hosts, are absent or switched off on current systems. Knock out either and the attack has nowhere to reflect.
A changed default is not a removed setting. The option is still there to be turned on, and in old networks it often still is, kept alive by an application nobody wants to touch; echo and chargen likewise survive in forgotten printers and appliances that shipped them enabled. A border that blocks the datagram from outside proves nothing about whether an internal host can aim one at a neighbouring subnet.
What a DDoS test measures
A live Fraggle across the public internet has nothing left to reflect off, so the useful exercise is internal and specific. Confirm directed broadcast is off on every segment, not only at the border. Confirm echo and chargen are disabled on hosts and on the network gear that historically enabled them. And confirm egress source-address validation (BCP 38) drops the spoofed source before it leaves, denying the attacker the forged victim address the whole thing depends on.
Those checks generalize. The reflection family stands or falls on whether spoofed sources are stopped at egress and whether the edge can absorb a wave of unsolicited replies, whatever protocol carries them this year. The size-amplifying service on the same port is treated on its own in chargen amplification.
Where the Fraggle attack sits among the reflection vectors it is usually filed beside is laid out in Understanding DDoS Attack Vectors.