I believe you've got this incorrect: We have the following: ServerWeb ServerDNS Attacker Background: To poison DNS for ServerWeb, Attacker will need to

I believe you've got this incorrect: We have the following: ServerWeb ServerDNS Attacker Background: To poison DNS for ServerWeb, Attacker will need to send forged DNS packets to ServerWeb from ServerDNS. However, ServerWeb will only accept packets for the short interval between requesting the lookup and receiving the reply. In practice, that makes poisoning the DNS extremely unlikely. DDoS protection: A completely unrelated attack on ServerWeb by Attacker is to send a spoofed DNS request to ServerDNS from ServerWeb. This DNS request uses very few bytes. However, the answer to this request sends many more bytes. This means that Attacker only needs X bandwidth to create a DDoS of 100X bandwidth on ServerWeb. To avoid this, ServerDNS will simply ignore these types of requests that generate a lot of data. The problem: If Attacker is able to make ServerWeb request these types of large response DNS queries from ServerDNS, ServerDNS will simply not reply. This is very good for Attacker as he now has a good 10 seconds or more to forge the correct request and poison ServerWeb. The attack shows how the complexity involved in DNS and other web protocols can quickly go out of control when making seemingly simple 'fixes' to stop newly discovered attacks. Understanding the repercussions of even minor changes to any part of the infrastructure can have unintended side effects.