The transaction ID for DNS queries can take values from 1 to 65,536 and my computer pseudorandomly chooses one for each DNS request. If I sents 1,024 false replies per request, how many requests should I trigger to compromise the DNS cache with probability 99%? or as close tot hat as I can get. Thanks

I'm getting a result of .6 requests which doesn't seem right to me. Feel as though it should be around 30


your calculation seems to be simplified. According to the formula given in RFC 5452, the number of fake packets 'F' that are candidates to be accepted is given by :

P_s = D * R * W / ( N * P * I )

where I is the number distinct IDs available (which is 65536 in your case), P is the number of ports used, N is the number of authoritative nameservers for a domain, R is the number of packets sent per second by the attacker, W is the window of opportunity, in seconds and D is the average number of identical outstanding queries of a resolver (typically 1, see Section 5).

If D = 1 (typical value according to the RFC), W = 0.1 (typical value according to the RFC), N = 2.5 (average value according to the RFC), P = 1 (assume only one port is used) and I = 65536 (provided in your question). Then P_s can be simplified into :

P_s = R / 1638400

Thus, plugging in the necessary values, for P_s to be 0.99, R should be greater than 1622016 packets/s. Since we used W = 0.1 and you send 1024 false replies per request, then you need about 1622016 * 0.1 / 1024 = 15.84 attempts.

(Hope my calculation is correct)

  • The final calculation comes out to 158.4 attempts not 15.84
    – s4ndhyac
    Mar 1 '19 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.