Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

Would this DoS attack be effective:

  1. Attacker determines target (10.0.0.1)

  2. Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1

  3. Servers reply to 10.0.0.1 with syn packets

Is the target effectively dosed or have we added an arbitrary steps to the equation?

share|improve this question

1 Answer

up vote 10 down vote accepted

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001.

UPDATE

Cloudflare blog entry about DNS Amplification DDoS, and follow-up with details about how Cloudflare deals with such things..

share|improve this answer
5  
DNS amplification attacks are a special kind, and worth covering in more detail. Essentially they work by sending a request whose response is known to be large, using a spoofed source IP. If the response is 800 bytes and your request is 100 bytes, you have an amplification factor of 8. This means that you can hit your target with 8 times the bandwidth you actually have access to. – Polynomial Oct 26 '12 at 6:10
Could this be used to even greater effect with multicast? – November Oct 26 '12 at 19:42
1  
@November No because multicast traffic requires a subscription by the router. Unlike unicast traffic, a stream can simply be turned off. – Jeff Ferland♦ Oct 30 '12 at 20:20
@November - the clearest explanation of multicast I found: www4.ncsu.edu/~rhee/clas/csc495j/ip-multicast-part1.pdf As Jeff Ferland notes, the routers have to be in on the multicast, so if you're not on the same subnet, you can't use multicast to amplify even further. – Bruce Ediger Oct 30 '12 at 20:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.