I'm designing a protocol similar to the DNS protocol but that may return more data. I have the option to use UDP or TCP. UDP is attractive because it is stateless, but it can also be used for DDOS.

What strategies can be used in the protocol to avoid that it may used for DDOS attacks ?

I read somewhere that NTP is now using a nonce. How does this work ?


Both UDP and TCP can be used for DDOS and there is nothing in these protocols which can protect against is. But what you probably mean is not a general DDOS attack but an amplification attack together with source spoofing.

Source spoofing means that the claimed source IP address of the client is different from the real source IP and thus the response will be sent not to the real client (the attacker) but to the claimed source (the target of the DDOS attack). Source spoofing is not possible with TCP since the initial handshake makes sure that the claimed client is actually the real client.

An amplification attack means that the response is considerable larger then the request, i.e. typically a DNS query is small but the DNS response can be really large if it contains lots of DNS records which is common for hosts with multiple IP addresses. Combined with source spoofing this means that an attacker with low bandwidth can cause an attack with high bandwidth against the target.

To protect against source spoofing use a protocol which is not affected like TCP or identify the client some other way, like through a shared secret. To protect against combining source spoofing with amplification make sure that your response is small at least as long as the client is not identified correctly to protect against source spoofing. Thus for a new client you could send a small response back containing a secret (nonce) and only for requests from clients containing this secret you will do a larger response.

Another protection against these kinds of attack is not at the protocol level but at the application level, in that you restrict the amount of data sent to a specific IP address, at least as long the client requesting these data was not properly identified.

  • Thank you vert much. Yes protecting against IP spoofing and amplification is the most important. A session ID generated by the server as a hash of the client IP and a server specific random key would do the trick. The server wouldn't have to track all identified clients. It can validate the source IP. The message returning the session ID would have to be very small to avoid amplification. Excellent. Thank you very much.
    – chmike
    Dec 20 '15 at 10:07
  • Unfortunately the method I described in the comment wouldn't work nicely with mobile phones that change IP address frequently. The other problem is that session ID would be transmitted in clear over the network. An attacker able to see the UDP datagrams received by its victim could issue session ID requests from many servers used in a future DDOS attack.
    – chmike
    Dec 20 '15 at 12:27
  • @chmike: since the client-IP is encoded in the token (session ID) an attacker could not use it with another client IP, i.e. in DDOS attacks using source spoofing. It could at most use it in attacks against the original client. Apart from that client IP address usually do not change that often even in mobile networks, since otherwise lots of other applications would not work. Dec 20 '15 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.