DNS Amplification Attacks

in this paper we address in detail how the recent dns ddos attacks work.
these dns attacks abuse name servers, edns, the recursive feature and udp packet spoofing, as well as how the amplification effect works.

our study is based on packet captures (we provide with samples) and logs from attacks on different networks reported to have a volume of 2.8gbps. one of these networks indicated some attacks have reached as high as 10gbps and used as many as 140,000 exploited name servers.

in the conclusions we also discuss some remediation suggestions.

given recent events, we have been encouraged to make this text available at this time.

url: http://www.isotf.org/news/dns-amplification-attacks.pdf

please note that this version of this paper is prior to submission for publication and that the final version may see significant revisions.

these attacks are also known as dns ddos reflector attacks or distributed reflected dns attacks.


randy vaughn and Sun Shine.

  • http://janantha.net Janantha

    Very interesting paper. DDOS are the hardest attacks to get protected from. I think the network devices should be a little bit more intelligent about the traffic its getting. The other option is to involve DMZ’s for public servers and also have external and internal firewalls for Local network protection. When attacks occur a redundant link can be activated for internet connectivity. Therefore closing down the link which is under attack.