Hacker News Reader

Comment by js2 | Hacker News Reader

It's a 12 byte header + the query section, which is 4 bytes + the qname, a sequence of labels. Each label is a length octet + the ascii encoded characters of the label. A query for "us" would be 12 + 4 (02 75 73 00) + 4 = 20 bytes, plus the IP header (20 bytes) + the UDP header (8 bytes), so 48 bytes.

https://www.ietf.org/rfc/rfc768.txt

https://www.ietf.org/rfc/rfc791.txt

https://www.ietf.org/rfc/rfc1035.txt

View on HN

Thanks :). So ~20 Gbit/s.

(Also: I want your username.)

You're definitely asking the right question, and IMO the answer is "sortof." It's not that impressive in the grand scheme of DDoS, given major attacks will sustain 100 gigabit traffic[1] sometimes for days on end. But 20gbit/s would likely be enough to take down a small & unprepared business.

[1]: http://www.techworld.com/news/security/worlds-largest-ddos-a...

20 Gbps definitely isn't very impressive given the current landscape, but it can probably take down many medium-sized businesses as well, if they have no DDoS mitigations. Even a large one, if they somehow had no mitigations or no decent security team.

20Gbps is actually still impressive if it is a set of valid requests like the parent seems to imply when doing the calculations. 20Gbps via a reflection technique is easy, but also relatively easy to filter and just requires a large pipe. 20Gbps of traffic doing legitimate requests that you can't immediately and trivially filter/rule out is still an impressive feat right now.

It's high, but DDoSs over 500 Gbps have been observed in the past 2 years. So relatively speaking, it's not that extraordinary.

Reply on news.ycombinator.com