I was reading about botnets and C&C servers and saw this term. I've read this Wikipedia article but I couldn't really understand what and how this is working. I think its some kind of proxy re-routing thing but I can't understand how this works, relationship with TTL values etc.

Can someone explain this technique from very beginning to end in detailed way? If possible, some examples will be very helpful to understand it completely.

  • Fast Flux sounds like a card game to me. But it's missing an x. ;-)
    – Iszi
    Mar 31, 2015 at 13:50

1 Answer 1


I think the linked Wikipedia article covers it quite simply.

Consider how many home users like to use a Dynamic DNS service to be able to reach their computer no matter what IP it has. The one computer reports its IP address on a regular basis, to a service which updates the DNS entry whenever the address changes. That way the DNS entry will always point to that computer no matter where the computer is or what IP it's using.

Now take that and blow it up into a botnet that's sharing a DNS entry. Each bot takes turns acting as the registered machine for the DNS entry. A short TTL is used on the entry so that it expires quickly, and doesn't point to the same IP for more than a few minutes. When the TTL is due to expire another bot is registered. Repeat the process ad infinitum until you're done needing the DNS entry or the Registrar shuts you down.

This is used to get around IP-based filtering or IDS which might otherwise inhibit the functionality of malware or other tools which rely upon access to an attacker-controlled network. The only way to block it is if you have a local DNS server you control that can black-hole lookups to the domain for your network, or if a Registrar agrees to shut the domain down.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .