Refer to the exhibit. An engineer is analyzing DNS response packets that are larger than expected. The engineer looks closer and notices a lack of appropriate DNS queries. What is occurring?

Question

Exhibit

Options

• ADNS cache poisoning
• BDNS tunneling
• CDNS hijack attack
• DDNS amplification attack

• A
  9% (5)
• B
  2% (1)
• C
  5% (3)
• D
  84% (47)

Explanation

DNS Amplification Attack takes advantage of the UDP-based nature of DNS, which allows a small query to generate a significantly larger response. Attackers send a DNS request with a spoofed source IP (the target's IP) to a vulnerable DNS server. The DNS server responds with a large response, amplifying the amount of traffic sent to Look for response packets with a size that is significantly larger than the queries. The image shows flows with a relatively high number of packets and bytes, which suggests larger-than- normal responses are being sent from the source IP (84.200.70.40) to different targets (195.165.10.x). This aligns with the symptom of larger-than-expected DNS responses. Typically, amplification exploits DNS records like ANY, which request all available information about a domain, producing a large response. One of the defining characteristics of a DNS Amplification Attack is IP spoofing. Attackers spoof the victim's IP address in the query, so the DNS server sends large responses to the victim. As a result, the target (victim) receives large DNS response packets that it never requested. A lack of appropriate DNS queries indicates that the responses are being sent without matching queries from the target IP addresses, which is consistent with an amplification attack. The targets did not initiate these requests, meaning the traffic is unwanted and spoofed.

No community discussion yet for this question.