I was talking earlier to a script kiddie and claimed that IP spoofing can increase the upload speed in a DDOS attack?! that does not make any sense to me According to him if your server has an upload speed of 1Gbps IP Spoofing will help you strike a target with a 10Gbps DDOS attack, any explanation? Thank you for your answers

  • It really theoretically could, if those limits are based on SRCIP. Spoofing SRC you'd have limit*src band. Anyway, it seems quite an unreal situation to me, since a real DDOS involves multiple nets with multiple confs. – user1293137 Jan 23 '14 at 12:00

He is referring to an attack such as a DNS Amplification Attack. He is not increasing his upstream, but he would be increasing the amount of data being sent to the target.

To make it simple:

  • Your friend ( wants to attack some server (
  • He spoofs his address to appear to come from the server (
  • He sends a DNS request to third party server consisting of ~60 bytes.
  • The DNS server responds back to the spoofed IP ( with a ~4000 byte reply.

You can find more details on the details of DNS amplification attacks here.

There are other services that are vulnerable to these types of attack too, including NTP. It also might be worth noting that in my experience, it is very rare that you will find a residential ISP that will forward spoofed packets.

| improve this answer | |
  • 2
    DNS, NTP, SNMP, etc. are all potential vectors for amplification. – Polynomial Jan 23 '14 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.