The flood of DNS responses came not from one single source, but from many (hence it’s called a “distributed” attack). There are no DNS requests present, which confirms that we are indeed hit by a DNS reflection attack. If you open the trace file with Wireshark, the display filter dns will show that all DNS responses carried information about the domain. Since DNS made the majority of packets, I took a closer look at DNS. The majority of packets were DNS packets with a bit of CLDAP in the mix. This attack is called DNS reflection and often used for distributed denial of service attacks, or DDoS for short. The trace file shows responses exceeding 4000 byte in length, amplifying the source traffic by a factor of 50. The attackers send a rather short request of 60-80 byte and generates a longer response that can reach 2000 or more byte. This technique of IP spoofing is long known and widely used by shady individuals in the Internet.

As a result the servers would deliver the result to us. The original requests were modified, so that the IP packets would show one of our source IP addresses as source. Someone had delivered a ton of unwanted DNS and LDAP responses to one of our systems. Interested readers find a packet sample in the download section. When checking a few log files, I noticed a short but significant spike in UDP traffic.

The new tool DNS Hammer can help in the review of a DNS server’s rate limiting configuration. Summary for busy readers (tl dr)ĭNS Servers without active rate limiting can be an involuntary contributor to a distributed denial of service attack (DDoS). The program can help auditing a DNS server’s rate limiting configuration.Ī dedicated web site offers the tool for download and instructions how to use it. This paves the way to our new tool DNS Hammer. DNS rate limiting can be used as mitigation against DNS reflection attacks. This article discusses DNS reflection, a technique used in DDoS attacks.

Wireshark dns analysis