Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do it(Having the risk of it being revealed) ? I do not understand the actual way


1 Answer 1


One possible way (UDP-Flood/Reflection/Amplification-Attack):

the attacker might use the zombies to invoke amplification/reflection-attacks like the ones performed some days ago link1 / link2; the attack was (probably) an NTP reflection attack

In other words:

  • you have 20.000 bots
  • you have a list of 100 vulnerable NTP-servers with an 100 mbit/s - uplink
  • you are able to flood any target with (theoretical) 10 GB/s UDP - traffic
  • the victim is attacked from the NTP-servers, who received spoofed requests from the bots

the same applies for DNS-amplification-attacks or any other UDP-based floods

picture taken from Secureworks-Blog DNS Amplification Variation Used in Recent DDoS Attacks

enter image description here

  • Nice answer , are the packets 'normal' or with some missing parts? Commented Jan 13, 2014 at 12:28
  • 1
    the packets are normal and legit, just with a spoofed sender-ip Commented Jan 13, 2014 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .