Exam 200-201 topic 1 question 380 discussion

Two protocols commonly used for DDoS (Distributed Denial of Service) amplification attacks are: DNS (Domain Name System): DNS amplification attacks exploit the large response sizes that can be generated by DNS queries. Attackers spoof the source IP address of the DNS query to make it appear as if it originated from the victim's IP address. The DNS servers then send their responses, which can be significantly larger than the original query, to the victim's IP address, flooding it with unwanted traffic. NTP (Network Time Protocol): NTP amplification attacks exploit the Monlist feature in older versions of NTP servers. Attackers send a specially crafted request to an NTP server, asking for a list of the last clients that connected to it (Monlist). The response generated by the NTP server can be much larger than the request, allowing attackers to amplify their attack traffic. This method is similar to DNS amplification but involves NTP servers instead.