A smurf attack is a Layer 3 reflection attack vector, one of the amplification classes a thorough DDoS test is built to exercise. Like every reflection attack it forges the victim's address as the source and lets innocent third parties do the flooding. What is specific to smurf is the amplifier it abuses: a network's directed broadcast address.
The broadcast multiplier
The attacker sends an ICMP echo request (a ping) to the broadcast address of a network, with the source IP spoofed to the victim. A router that forwards directed broadcasts delivers that one packet to every host on the subnet, and each host dutifully answers the echo. Because they all believe the request came from the victim, every reply lands on the victim at once.
The multiplier is therefore the number of live hosts on the abused network, not a fixed protocol ratio. A subnet with 200 responding hosts turns one packet into 200 replies; aim the same trick at several large networks and the factor compounds. This is what separates smurf from a DNS or NTP reflector, where the gain comes from a single response much larger than the request. Smurf's gain is a response many times more numerous. Each reply is an ordinary-sized ICMP echo; the count is the weapon.
The UDP twin of this attack is fraggle, which points the same broadcast trick at UDP echo and chargen ports instead of ICMP. Same mechanism, different protocol.
Why it is mostly historical
Smurf was among the most destructive attacks of the late 1990s. The 1998 wave against ISPs worked because networks that forwarded directed broadcasts were everywhere, and public "smurf amplifier" lists circulated so an attacker could pick the fattest multipliers on the internet.
The structural fix was to stop forwarding directed broadcasts. RFC 2644 changed the default so routers no longer relay a packet aimed at a subnet's broadcast address, and modern hardware ships with it disabled. That removes the amplifier and makes a classic smurf close to unreproducible on a well-run network.
The pattern did not die with it. Spoof the source, borrow someone else's infrastructure as a multiplier: that is the template every modern reflection vector still follows, from NTP to memcached. Source-address validation (BCP 38) at the carrier level is the same one-network-fixes-it-for-everyone control that would have killed smurf and still limits its descendants.
Where directed broadcast still survives
The default changed, which is not the same as the setting being gone. RFC 2644 governs what a router does out of the box, and a network that has run for a long time carries decisions nobody has revisited. Directed broadcast is still switchable, and it is still switched on in places, usually because some legacy application depended on it and the exception outlived the application.
Internal networks are where that survives. A perimeter that drops directed broadcast from outside says nothing about whether a host inside the network can aim one at another subnet, which matters once an attacker already has a foothold or a compromised device on the inside. The multiplier is smaller than the internet-scale amplifier lists of 1998, and against a single internal service it is still enough.
The other reason to know the mechanism is that it names a family. Its UDP twin, the fraggle attack, does the same thing to the echo and chargen services, and the same misconfiguration enables both. A network that has never checked its directed-broadcast posture has not checked for either.
What a DDoS test measures
There is little point firing a literal smurf across the internet, because the public amplifier is gone. What is worth checking is narrower and still real: whether directed broadcast is disabled on every internal segment rather than only at the perimeter, and whether the answer is the same on the equipment nobody has reconfigured in years. What a test exercises is the class the attack founded: whether the edge absorbs and filters high volumes of unsolicited reply traffic, and whether anti-spoofing and source-address validation hold across the reflection family rather than the one protocol in fashion this year. The amplification lineage from smurf to memcached is traced in Understanding DDoS Attack Vectors.