Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do it(Having the risk of it being revealed) ? I do not understand the actual way

share|improve this question
up vote 3 down vote accepted

one possible way (UDP-Flood/Reflection/Amplification-Attack):

the attacker might use the zombies to invoke amplification/reflection-attacks like the ones performed some days ago link1 / link2; the attack was (probably) a ntp reflection attack

with other words:

  • you have 20.000 bots
  • you have a list of 100 vulnerable ntp-servers with an 100 mbit/s - uplink
  • you are able to flood any target with (theoretical) 10 GB/s UDP - traffic
  • the victim is attacked from the ntp-servers, who received spoofed requests from the bots

the same applies for dns-amplification-attacks or any other UDP-based floods

picture taken from Secureworks-Blog DNS Amplification Variation Used in Recent DDoS Attacks


share|improve this answer
Nice answer , are the packets 'normal' or with some missing parts? – user3029101 Jan 13 '14 at 12:28
the packets are normal and legit, just with a spoofed sender-ip – that guy from over there Jan 13 '14 at 13:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.