Routing Loops as Mega Amplifiers for DNS-based DDoS Attacks

Yevheniya Nosyk (1, 2, 3) , Maciej Korczyński (1, 2, 4) , Andrzej Duda (1, 2, 4)

1 LIG - Laboratoire d'Informatique de Grenoble
2 Drakkar
3 UGA - Université Grenoble Alpes
4 Grenoble INP - Institut polytechnique de Grenoble - Grenoble Institute of Technology

DDoS attacks are one of the biggest threats to the modern Internet as their magnitude is constantly increasing. They are highly effective because of the amplification and reflection potential of different Internet protocols. In this paper, we show how a single DNS query triggers a response packet flood to the query source, possibly because of middleboxes located in networks with routing loops. We send DNS A requests to 3 billion routable IPv4 hosts and find 15,909 query destinations from 1,742 autonomous systems that trigger up to 46.7 million repeating responses. We perform traceroute measurements towards destination hosts that resulted in the highest amplification, locate 115 routing loops on the way, and notify corresponding network operators. Finally, we analyze two years of historical scan data and find that such "mega amplifiers" are prevalent. In the worst case, a single DNS A request triggered 655 million responses, all returned to a single host.

Keywords: DDoS; DNS resolvers; Amplification attacks; Reflection attacks; Routing loops

Domains: Networking and Internet Architecture [cs.NI]

Yevheniya Nosyk, Maciej Korczyński, Andrzej Duda. Routing Loops as Mega Amplifiers for DNS-based DDoS Attacks. International Conference on Passive and Active Network Measurement, Mar 2022, Virtual Event, Netherlands. pp.629-644, ⟨10.1007/978-3-030-98785-5_28⟩. ⟨hal-04027472⟩