Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Would this DoS attack be effective:

  1. Attacker determines target (

  2. Attacker sends ack packets to a buch of web servers with a src addr of

  3. Servers reply to with syn packets

Is the target effectively dosed or have we added an arbitrary steps to the equation?

share|improve this question
up vote 11 down vote accepted

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001.


Cloudflare blog entry about DNS Amplification DDoS, and follow-up with details about how Cloudflare deals with such things..

share|improve this answer
DNS amplification attacks are a special kind, and worth covering in more detail. Essentially they work by sending a request whose response is known to be large, using a spoofed source IP. If the response is 800 bytes and your request is 100 bytes, you have an amplification factor of 8. This means that you can hit your target with 8 times the bandwidth you actually have access to. – Polynomial Oct 26 '12 at 6:10
Could this be used to even greater effect with multicast? – November Oct 26 '12 at 19:42
@November No because multicast traffic requires a subscription by the router. Unlike unicast traffic, a stream can simply be turned off. – Jeff Ferland Oct 30 '12 at 20:20
@November - the clearest explanation of multicast I found: As Jeff Ferland notes, the routers have to be in on the multicast, so if you're not on the same subnet, you can't use multicast to amplify even further. – Bruce Ediger Oct 30 '12 at 20:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.