I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them?

It seems DNS amplifier attack not just reflect but also "amplifier" the traffic and I suspect this is the main difference here. How does it amplify the traffic?

Can I say that if an attacker sends packets to one DNS recursor, then it's a DNS flood (the number of packets is the same as send), to multiple recursors, then this is an amplifier attack. The number of packets = send packets * number of recursor severs, and that is why it's called "amplification"?


DNS Flood

A type of Distributed Denial of Service (DDoS) attack in which the attacker targets one or more Domain Name System (DNS) servers belonging to a given zone, attempting to hamper resolution of resource records of that zone and its sub-zones. Incapsula

enter image description here DNS Flood

DNS Amplification attack

In a DNS amplification attack, a large number of DNS request are sent with a spoofed from-IP-address to one or more DNS servers. Depending on configuration, these DNS servers will send a response back to the IP address that the request appeared to originate from. SimpleDNS.

enter image description here DNS Amplification DDoS Attack

Although, US Cert and CloudFlare both have good definitions I felt they lacked simplification. However, I have included them as citation because they include technical workings.

DNS flood attacks use the high bandwidth connections of botnets to directly overwhelm the DNS servers via DDoS attack. The volume of requests from the botnet devices overwhelms the DNS provider’s services and prevents legitimate users from accessing the provider's DNS servers.

DNS flood attacks differ from DNS amplification attacks. Unlike DNS floods, DNS amplification attacks reflect and amplify traffic off unsecured DNS servers in order to hide the origin of the attack and increase its effectiveness. DNS amplification attacks can use devices with smaller bandwidth connections to make numerous requests to unsecured DNS servers. The devices make many small requests for very large DNS records, but when making the requests, the attacker forges the return address to be that of the intended victim. The amplification allows the attacker to take out larger targets with only limited attack resources. Although DNS amplification is not reserved for low bandwidth, it is the ideal attack method if high bandwidth is not available.

| improve this answer | |
  • I think some of your focus is unnecessary and not strictly correct. A DNS flood attack doesn't have to use IoT devices. Any source of network traffic will do, whether that is IoT devices or hacked computers. Similarly DNS amplification attacks aren't tied to low-bandwidth devices. The amplification part is a big plus regardless of whether you are using low-bandwidth or high-bandwidth devices/networks. – Conor Mancone Aug 16 '18 at 19:24
  • I would have prefered writing my own definitions. Although, I wanted sources to quote from sources. DNS flood acts as a DDoS, using multiple machines (likely bots), which is why IoT came into the part. And I absolutely agree, DNS amplification attacks aren't tied to low bandwidth devices, but rather this shows how dangerous this type of attack is. I have updated this to mitigate any misleading perspectives. Although, I feel it goes beyond the scope of this question. – safesploit Aug 16 '18 at 19:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.