Isn't the 440 figure disingenuous? Surely you must count UDP/TCP header size, which would bring the value closer to 21/461 ~= 22.
Still an interesting discovery. DDoS amplification is a security risk few people consider when developing applications.
Still an interesting discovery. DDoS amplification is a security risk few people consider when developing applications.
The first is better for 'anonymous' services; require the client to send a packet of the same size as the buffer they want to receive. It's network in-efficient but for small requests better than the delay in setting up an actual session. It eliminates the chance of amplification attacks.
The second is to establish /some/ kind of session. This might be as 'simple' as logging in, or it could just involve a few round trip communications that indicate the client /is/ listening to server replies. That eliminates every DDoS style except for a man in the middle capable amplification vectors; yet if MitM is possible then why bother with DDoS.
Header size is 8-20 (without options) and if you read the article closelyer you'll see the total packet size was 480ish.
I dont know how you are getting 21/461 = 22 ?
the average packet size was 483 bytes (average data
length = 441 bytes)
My point is: this is important, but not a 440x amplification attack.