Take the 2-minute tour ×

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do it(Having the risk of it being revealed) ? I do not understand the actual way

share|improve this question

1 Answer 1

up vote 3 down vote accepted

one possible way (UDP-Flood/Reflection/Amplification-Attack):

the attacker might use the zombies to invoke amplification/reflection-attacks like the ones performed some days ago link1 / link2; the attack was (probably) a ntp reflection attack

with other words:

  • you have 20.000 bots
  • you have a list of 100 vulnerable ntp-servers with an 100 mbit/s - uplink
  • you are able to flood any target with (theoretical) 10 GB/s UDP - traffic
  • the victim is attacked from the ntp-servers, who received spoofed requests from the bots

the same applies for dns-amplification-attacks or any other UDP-based floods

picture taken from Secureworks-Blog DNS Amplification Variation Used in Recent DDoS Attacks


share|improve this answer
Nice answer , are the packets 'normal' or with some missing parts? –  user3029101 Jan 13 at 12:28
the packets are normal and legit, just with a spoofed sender-ip –  that guy from over there Jan 13 at 13:34

Your Answer


