Routing Loops as Mega Amplifiers for DNS-based DDoS Attacks - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Routing Loops as Mega Amplifiers for DNS-based DDoS Attacks

Résumé

DDoS attacks are one of the biggest threats to the modern Internet as their magnitude is constantly increasing. They are highly effective because of the amplification and reflection potential of different Internet protocols. In this paper, we show how a single DNS query triggers a response packet flood to the query source, possibly because of middleboxes located in networks with routing loops. We send DNS A requests to 3 billion routable IPv4 hosts and find 15,909 query destinations from 1,742 autonomous systems that trigger up to 46.7 million repeating responses. We perform traceroute measurements towards destination hosts that resulted in the highest amplification, locate 115 routing loops on the way, and notify corresponding network operators. Finally, we analyze two years of historical scan data and find that such "mega amplifiers" are prevalent. In the worst case, a single DNS A request triggered 655 million responses, all returned to a single host.
Fichier principal
Vignette du fichier
PAM2022Nosyk.pdf (275.56 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04027472 , version 1 (13-03-2023)

Identifiants

Citer

Yevheniya Nosyk, Maciej Korczyński, Andrzej Duda. Routing Loops as Mega Amplifiers for DNS-based DDoS Attacks. International Conference on Passive and Active Network Measurement, Mar 2022, Virtual Event, Netherlands. pp.629-644, ⟨10.1007/978-3-030-98785-5_28⟩. ⟨hal-04027472⟩
16 Consultations
96 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More