3 ms·
I'm not a networking expert either, but I do believe the recursive nature turns this amplification DDoS to just a "normal" DDoS where the only target would be t
by uxp 14y ago
I'm not a networking expert either, but I do believe the recursive nature turns this amplification DDoS to just a "normal" DDoS where the only target would be the nameservers of the target service. At the end of the day, if there wasn't a single nameserver that was turning around and asking 2, 10, or 100 other nameservers the same fraudulent question they didn't have the answer to, the only thing you could do with the same exact attack would be to take out someone's authoritative servers. No collateral damage by slowing down the internet connections of home users in California when the attack is being targeted at some server in Germany.
- drchaos 14y agoI don't think the nameserver (or the upstream NS) is the target of the attack, but the (spoofed) IP which appears to be sending the queries: * Attacker sends (small) query to a lot of resolvers, spoofing the source adress to be the IP of the target * Each NS replies with a (large) response, thus flooding the target with a lot of data As long as there is no rate limiting in the nameservers used for the attack, this would work regardless of whether the answer is authoritative or not.