DNS Amplification Attack

A DNS amplification attack is a reflection DDoS technique. The attacker sends many small UDP queries to DNS servers with the source address forged to be the victim's. Each server replies with a much larger answer, so the victim receives far more traffic than the attacker had to send.

Why it matters

UDP does not verify the sender, so spoofing is possible on networks that do not filter outgoing packets. Queries for large records, such as DNSKEY, TXT or ANY (where supported), give the biggest ratio. Open recursive resolvers and misconfigured authoritative servers are the typical reflectors. Defenders reduce exposure by closing open resolvers, applying response rate limiting (RRL) on authoritative servers and having networks follow BCP 38 source address validation. Victims usually rely on upstream scrubbing or anycast capacity.

Example

Attacker -> open resolver : 64-byte query, source = victim IP
Open resolver -> victim   : several-kilobyte response

The exact ratio depends on the records requested and the resolver, so figures vary widely.

Common mistakes

• Running a recursive resolver reachable from the whole internet.
• Believing it only affects DNS servers. The victim can be any host.
• Blocking port 53 on the victim instead of mitigating upstream.

Related

• DDoS
• UDP
• Anycast
• Rate limiting

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.