AT19: DNS Flood
Definition
An application-specific variation of the UDP Flood. During a DNS flood, a victim DNS server receives valid but spoofed DNS request packets at a very high packet rate and from a very large pool of source IP. The victim server cannot determine which packet is from a real server and therefore proceeds to respond to all requests. The server is overwhelmed by the requests. This attack consumes network resources and available bandwidth that exhausts the network until it shuts down.
Spoofed DNS attacks are well-crafted flood attacks – the content of spoofed DNS packets are designed to mimic actual DNS requests. Since they are 100% normal looking packets, this attack is not detectable by deep packet inspection alone. With a wide range of available attacking IP, the attacker can easily evade most traffic anomaly detection techniques.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | -- | Very Large | Very High | Small | Valid | -- | -- | -- | -- |
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Verify DNS Query/responses (RIOS 5.4.12 or greater) | Enabled | When enabled, this control will verify that DNS queries and responses conform to standards. |
| Enable duplicate query/response test (RIOS 5.4.12 or greater) | Enabled | When enabled, this control enables testing for excessive duplicate DNS queries and responses. |
| Allow zero questions (RIOS 7.0.0 or greater) | Enabled | When enabled, this control allows DNS packets that contain zero questions. Traditional DNS queries and responses as outlined in RFC 1035 always involve a "question". However, later modifications to DNS (RFC 2136, among others) allow messages that may not have a question section (such as in dynamic DNS updates). If disabled, a DNS packet without a question will be dropped. |
| Maximum padding size (RIOS 7.0.0 or greater) | 8 (0-512) | This control sets the maximum number of bytes that can be used to pad the DNS packet. |
| Maximum requests allowed per minute (RIOS 7.0.0 or greater) | 0 (0-65535) | When 0, this control is disabled. For any other allowed value, that is the maximum number of DNS requests that are allowed into the zone per minute. Violations will be reported as subtype 14. |
| Maximum responses allowed per minute (RIOS 7.0.0 or greater) | 0 (0-65535) | When 0, this control is disabled. For any other allowed value, that is the maximum number of DNS responses that are allowed into the zone per minute. Violations will be reported as subtype 15. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT19 | 1 | No payload |
| AT19 | 2 | Invalid DNS query packet flood |
| AT19 | 3 | Invalid DNS answer packet flood |
| AT19 | 4 | Duplicate DNS query flood |
| AT19 | 5 | Duplicate DNS response flood |
| AT19 | 6 | DNS queries with extra data |
| AT19 | 7 | DNS responses with extra data |
| AT19 | 8 | DNS queries with suspect labels |
| AT19 | 9 | DNS responses with suspect labels |
| AT19 | 10 | Excessive DNS queries with non-zero rcode |
| AT19 | 11 | Excessive DNS responses with non-zero rcode |
| AT19 | 12 | Excessive DNS queries with ANY question |
| AT19 | 13 | Excessive DNS responses with ANY question |
| AT19 | 14 | DNS query rate limit exceeded |
| AT19 | 15 | DNS response rate limit exceeded |
| AT19 | 23 | Invalid DNS packet flood |