DNS放大攻击
Embed This Widget
Add the script tag and a data attribute to embed this widget.
Embed via iframe for maximum compatibility.
<iframe src="https://tldfyi.com/iframe/glossary/dns-amplification/" width="420" height="400" frameborder="0" style="border:0;border-radius:10px;max-width:100%" loading="lazy"></iframe>Paste this URL in WordPress, Medium, or any oEmbed-compatible platform.
https://tldfyi.com/glossary/dns-amplification/Add a dynamic SVG badge to your README or docs.
[](https://tldfyi.com/glossary/dns-amplification/)Use the native HTML custom element.
DNS放大攻击是一种利用开放[[recursive-dns|DNS解析器]]向受害者发起大量流量的分布式拒绝服务（DDoS）攻击。攻击者在基于UDP的[[dns|DNS]]查询中伪造受害者的[[ip-address|IP地址]]，并将其发送到开放解析器，然后解析器将比查询大数百倍的响应（通常是启用[[edns|EDNS]]或带[[dnssec|DNSSEC]]签名的记录）直接发送给受害者。50倍至70倍的放大系数很常见，使这类攻击对攻击者极具带宽效率。缓解措施包括权威服务器上的响应速率限制（RRL）、防止IP欺骗的BCP38入站过滤，以及将开放递归解析限制为仅授权客户端。
示例
An attacker sending 1 Gbps of spoofed DNS queries to open resolvers can generate 50–70 Gbps of response traffic directed at a victim, overwhelming their network with a fraction of the upstream bandwidth required.