Welcome to Information Security Stack Exchange

Information Security Stack Exchange is a question and answer site for Information security professionals. It's built and run by you as part of the Stack Exchange network of Q&A sites. With your help, we're working together to build a library of detailed answers to every question about Information security.

We're a little bit different from other sites. Here's how:


Ask questions, get answers, no distractions

This site is all about getting answers. It's not a discussion forum. There's no chit-chat.

Just questions...

...and answers.

up vote

Good answers are voted up and rise to the top.

The best answers show up first so that they are always easy to find.

accept

The person who asked can mark one answer as "accepted".

Accepting doesn't mean it's the best answer, it just means that it worked for the person who asked.

Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?

up vote 14 down vote favorite

I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports. If the all the DNS response go to a Authoritative Nameserver(victim), it can just drop all DNS response.

Or is DNS Amplification all about bandwidth?

2 Answers

up vote 4 down vote accept

DNS Amplification attacks are very easy to prevent by filtering UDP packets at the edge routers. This is how Cloudflare is able to easily thwart a 300+ gb/s DDoS attack.

up vote 3 down vote

The problem is that you need to drop the traffic before it reaches your network. So even when dropping packets at your server is way too late. The best way to reduce risk is to use packet scrubbing services like Akamai or Cloudfare who have DDoS mitigation techniques in place to prevent this traffic from reaching your network.


Get answers to practical, detailed questions

Focus on questions about an actual problem you have faced. Include details about what you have tried and exactly what you are trying to do.

Ask about...

  • Specific issues regarding the protection of assets from threats and vulnerabilities
  • Real problems or questions that you’ve encountered

Not all questions work well in our format. Avoid questions that are primarily opinion-based, or that are likely to generate discussion rather than answers.

Questions that need improvement may be closed until someone fixes them.

Don't ask about...

  • Anything not directly related to Information security
  • Questions that are primarily opinion-based
  • Questions with too many possible answers or that would require an extremely long answer

Tags make it easy to find interesting questions

All questions are tagged with their subject areas. Each can have up to 5 tags, since a question might be related to several subjects.

Click any tag to see a list of questions with that tag, or go to the tag list to browse for topics that interest you.

Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?

up vote 14 down vote

I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports. If the all the DNS response go to a Authoritative Nameserver(victim), it can just drop all DNS response.

Or is DNS Amplification all about bandwidth?


You earn reputation when people vote on your posts

Your reputation score goes up when others vote up your questions, answers and edits.

+5 question voted up
+10 answer voted up
+15 answer is accepted
+2 edit approved

As you earn reputation, you'll unlock new privileges like the ability to vote, comment, and even edit other people's posts.

Reputation Privilege
15 Vote up
50 Leave comments
125 Vote down (costs 1 rep on answers)

At the highest levels, you'll have access to special moderation tools. You'll be able to work alongside our community moderators to keep the site focused and helpful.

2000 Edit other people's posts
3000 Vote to close, reopen, or migrate questions
10000 Access to moderation tools
see all privileges

Improve posts by editing or commenting

Our goal is to have the best answers to every question, so if you see questions or answers that can be improved, you can edit them.

Use edits to fix mistakes, improve formatting, or clarify the meaning of a post.

Use comments to ask for more information or clarify a question or answer.

You can always comment on your own questions and answers. Once you earn 50 reputation, you can comment on anybody's post.

Remember: we're all here to learn, so be friendly and helpful!

up vote 9 down vote

DNS Amplification attacks are very easy to prevent by filtering UDP packets at the edge routers. This is how Cloudflare is able to easily thwart a 300+ gb/s DDoS attack.

edit

@Steel City Hacker so did you just say: "if you do what cloudflare does then you will fail because you are not using a service like cloudflare"... - Rook May 21 '13 at 21:48

add comment


Unlock badges for special achievements

Badges are special achievements you earn for participating on the site. They come in three levels: bronze, silver, and gold.

In fact, you can earn a badge just for reading this page:

 Informed Read the entire about page
 Student Asked first question with score of 1 or more
 Editor First edit
 Good Answer Answer score of 25 or more
 Civic Duty Voted 300 or more times
 Famous Question Asked a question with 10,000 views

see all badges


Find a question to answer, or ask your own

Looking for more in-depth information on the site? Visit the Help Center

Information Security Stack Exchange is part of the Stack Exchange network

Like this site? Stack Exchange is a network of 118 Q&A sites just like it. Check out the full list of sites.

Stack Exchange