Hacker News new | past | comments | ask | show | jobs | submit login

I don't think the nameserver (or the upstream NS) is the target of the attack, but the (spoofed) IP which appears to be sending the queries:

* Attacker sends (small) query to a lot of resolvers, spoofing the source adress to be the IP of the target

* Each NS replies with a (large) response, thus flooding the target with a lot of data

As long as there is no rate limiting in the nameservers used for the attack, this would work regardless of whether the answer is authoritative or not.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: