As title says, what is the difference between DNS flood attack and UDP flood attack?

Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, memory, etc?

  • Honestly, I think those two issue are well described inside wikipedia. You second question scope is quite broad, as corporate DNS and ISP DNS protection level are totally different. Some ISP may blocked excessive UDP request to particular IP. – mootmoot Sep 3 '18 at 15:35

A DNS flood attack is (or can be, you can do DNS over TCP as well) a more specific type of UDP flood attack, where DNS is used to generate large DNS answers to spoofed DNS queries. Other protocols like NTP and SNMP are popular other types of UDP based flood attacks. All UDP attacks use some higher level protocol to generate the actual data for the attack.

As with most DDoS attack types, the weakest link in the chain goes first. Often, this would be bandwidth, but if a server would have enough bandwidth it's very well possible that the server which is under attack would be overloaded another way (CPU, memory, logs filling up disks, etc).

| improve this answer | |
  • Is it the same case for DNS amplification attacks? As if the server's network bandwidth is large enough to handle vast amount of DNS replies, but the server assets like CPU, memory,... get exhausted? – eliwax Sep 3 '18 at 15:11
  • Yes, see the second paragraph of my answer. – Teun Vink Sep 3 '18 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.