Service Denial Attacks

This chapter discusses the domain name system (DNS)‐specific denial of service (DoS) attacks that exhaust DNS server resources using the DNS protocol or internet protocol (IP) packets in general. It begins by reviewing the various attack forms, and then discusses detection and defensive approaches. Symptoms of service denial attacks generally include a slowing or a complete halting of the ability to receive a response from the victim system. DNS packet and query measurements as recorded at each server and tracked over time can likewise provide a baseline against which anomalous traffic patterns can be compared. Ideally, measurements at multiple layers of the stack, that is, for IP, UDP/TCP, and DNS layers provide the granularity to identify UDP floods versus DNS protocol layer attacks. Effective DoS mitigation requires constraining the level of server processing for attack packets such that legitimate packets are still handled properly to minimize collateral damage.