MS SQL Server Resolution Service enables reflected DDoS with 440x amplification

Re:MS SQL Server Resolution Service enables reflected DDoS w... by chpp on Wednesday January 21, 2015 @04:52PM (#8926019)

Won't somebody think of the routers?!

Header size is 8-20 (without options) and if you read the article closelyer you'll see the total packet size was 480ish.

I dont know how you are getting 21/461 = 22 ?

[ Parent | on HN ]

Re:MS SQL Server Resolution Service enables reflected DDoS w... by BoppreH on Wednesday January 21, 2015 @06:02PM (#8926394)

I was being handwavy with the values (adding a fixed 20 bytes for header), but let's try something more precise:

    the average packet size was 483 bytes (average data
    length = 441 bytes)

So header size is 42 bytes (483 - 441). Assuming the request uses the same headers, we have 483 / (1+42) = 11.23 amplification.

My point is: this is important, but not a 440x amplification attack.

[ Parent | on HN ]