3 ms·
Isn't the 440 figure disingenuous? Surely you must count UDP/TCP header size, which would bring the value closer to 21/461 ~= 22. Still an interesting discover
by BoppreH 12y ago
Isn't the 440 figure disingenuous? Surely you must count UDP/TCP header size, which would bring the value closer to 21/461 ~= 22.
Still an interesting discovery. DDoS amplification is a security risk few people consider when developing applications.
- mjevans 12y agoAgreed. As I see it there are two main design methods for overcoming this issue. The first is better for 'anonymous' services; require the client to send a packet of the same size as the buffer they want to receive. It's network in-efficient but for small requests better than the delay in setting up an actual session. It eliminates the chance of amplification attacks. The second is to establish /some/ kind of session. This might be as 'simple' as logging in, or it could just involve a few round trip communications that indicate the client /is/ listening to server replies. That eliminates every DDoS style except for a man in the middle capable amplification vectors; yet if MitM is possible then why bother with DDoS.
- chpp 12y agoI guess we are throwing UDP out the windows all together now? ;)
- chpp 12y agoWon't somebody think of the routers?! Header size is 8-20 (without options) and if you read the article closelyer you'll see the total packet size was 480ish. I dont know how you are getting 21/461 = 22 ?
- BoppreH 12y agoI was being handwavy with the values (adding a fixed 20 bytes for header), but let's try something more precise: the average packet size was 483 bytes (average data length = 441 bytes) So header size is 42 bytes (483 - 441). Assuming the request uses the same headers, we have 483 / (1+42) = 11.23 amplification. My point is: this is important, but not a 440x amplification attack.