Why are UDP-based protocols (like DNA or NTP) commonly used for 'Amplification' DDoS attacks?
- A UDP-based protocols utilize a mandatory, high-level cryptographic encryption routine that is mathematically optimized for flooding the victim's edge-level firewall.
- B UDP allows for source IP spoofing (due to the lack of a handshake) and often features protocols where a small request triggers a disproportionately large response from the server.
- C UDP is fundamentally slower than TCP, which causes a significant backlog of unproccessed data packets that eventually clog the victim's internal switching fabric.
- D These protocols specifically run on port 80 and port 443, allowing the malicious traffic to bypass the vast majority of modern enterprise-level security monitoring tools.
Amplification attacks turn a small spark into a wildfire. An attacker sends a tiny request (e.g., 'Tell me every record for this domain') to an open DNS or NTP server. They 'spoof' the sender's IP address to be that of the victim. Because UDP doesn't have a 3-way handshake to verify the sender, the server blindly sends a massive response (often 50x larger than the request) directly to the victim. By using thousands of these 'open reflectors', a hacker can generate terabits of traffic from a relatively weak connection. This highlights a fundamental trade-off: the efficiency and simplicity of UDP protocols can be weaponized if they are not properly secured against spoofing.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- What is the downside of enabling 'Sticky Sessions' (Session Affinity) on a Load Balancer?
- In WebRTC (P2P Mesh), why is a STUN server required?
- What is the fundamental difference between a Network Switch and a Router?
- In Cloud Networking (AWS), what is the limitation of VPC Peering compared to a Transit Gateway?
- Which protocol is ideal for real-time multiplayer gaming positions or Voice over IP (VoIP), and why?
- What is the purpose of the 'Time To Live' (TTL) field in an IP packet?