8

I've read about DDoS attacks and specially the amplification techniques. For example, the DNS amplification technique where you can send queries to open resolvers pretending to be the victim, then [if nobody is filtering packets] the victim will get all the responses and if the traffic is high enough, get overwhelmed and stop functioning the way it is supposed to.

If I understand that correctly, the DNS response will be sent from the open resolver with an arbitrary destination port that the victim is not listening to (cuz he didn't make the request, thus not waiting for a response on that port!). How does that affect the victim? Can you get overwhelmed by receiving too many packets wrongly addressed to a port where you are not listening? Is it an expensive operation to ignore packets? Or am I getting it wrong somehow?

Improve this question
5
  • @amyassin In order to deny traffic, you have to read some of the data. That's because your computer needs to know what the port number or IP address's are.
    – Kayla
    Commented Mar 7, 2015 at 0:32
  • 4
    How come the air is filled with excess sound waves if I'm not listening to the music from that loud speaker?
    – Lie Ryan
    Commented Mar 7, 2015 at 1:14
  • 1
    We expect you to do a significant amount of research before asking. The Wikipedia page on DDoS already explains how this works. So what specifically is your confusion? If you haven't read the Wikipedia article (or that level of explanation of DDoS), you certainly haven't done enough research on your own before asking. This site is for IT Security professionals; professionals do their research.
    – D.W.
    Commented Mar 7, 2015 at 1:27
  • Possible duplicate of security.stackexchange.com/q/4667/971 (which was the first question that the site automatically picked under the Related column). See also security.stackexchange.com/q/22809/971 (also auto-suggested as Related).
    – D.W.
    Commented Mar 7, 2015 at 1:30
  • Like always, the "professional" that pops to RTFM people is the least understanding person of what the question is about...
    – amyassin
    Commented Mar 7, 2015 at 7:18

1 Answer 1

Reset to default
11

Ignoring packets is cheap, but if your connection is unable to handle the sheer volume of traffic per second then you're going to fall down hard. The only answer at that point is to filter traffic upstream of you. Because things are distributed and high performance routers really don't like consulting a large routing table just to play whack-a-mole on which hosts to drop, that can get unwieldy.

That last part is what makes a DDoS so effective: that it's hard to reroute traffic upstream. CloudFlare makes a business out of having enough bandwidth to absorb all the traffic and deal with it without having to filter upstream at providers.

Improve this answer
6
  • 2
    Oh so the trick is to saturate the link with garbage, not overwhelm the server processing powers??
    – amyassin
    Commented Mar 6, 2015 at 21:45
  • I understand that Cloudflare can have enough bandwidth to absorb all the traffic, filter it and only send the real client to you. But, if the attacker find your real IP (not your fake cloudflare IP), you will still be vulnerable to DDoS right?
    – Gudradain
    Commented Mar 6, 2015 at 22:00
  • to overwhelming your link? I guess so. But not other types if you are filtering your traffic to only accept traffic from cloudflare IP addresses..
    – amyassin
    Commented Mar 6, 2015 at 22:30
  • 1
    @Gudradain Yes, you are supposed to do your best to hide your real IP. CloudFlare has a blog post on this subject: blog.cloudflare.com/ddos-prevention-protecting-the-origin
    – tlng05
    Commented Mar 6, 2015 at 22:44
  • CloudFlare also has the benefit of being able to use anycast routing to distribute the load of the attack away from the target - a luxury you don't have at the ISP level, let alone at your router.
    – Polynomial
    Commented Mar 6, 2015 at 23:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .