When the dike breaks: Dissecting DNS defenses during DDos

Giovane C.M. Moura, John Heidemann, Moritz Müller, Ricardo O. De Schmidt, Marco Davids

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

41 Citations (Scopus)
2 Downloads (Pure)


The Internet's Domain Name System (DNS) is a frequent target of Distributed Denial-of-Service (DDoS) attacks, but such attacks have had very different outcomesÐsome attacks have disabled major public websites, while the external effects of other attacks have been minimal. While on one hand the DNS protocol is relatively simple, the system has many moving parts, with multiple levels of caching and retries and replicated servers. This paper uses controlled experiments to examine how these mechanisms affect DNS resilience and latency, exploring both the client side's DNS user experience, and server-side traffic. We find that, for about 30% of clients, caching is not effective. However, when caches are full they allow about half of clients to ride out server outages that last less than cache lifetimes, caching and retries together allow up to half of the clients to tolerate DDoS attacks longer than cache lifetimes, with 90% query loss, and almost all clients to tolerate attacks resulting in 50% packet loss. While clients may get service during an attack, tail-latency increases for clients. For servers, retries during DDoS attacks increase normal traffic up to 8×. Our findings about caching and retries help explain why users see service outages from some real-world DDoS events, but minimal visible effects from others.

Original languageEnglish
Title of host publicationIMC 2018 - Proceedings of the Internet Measurement Conference
PublisherAssociation for Computing Machinery
Number of pages14
ISBN (Electronic)9781450356190
Publication statusPublished - 31 Oct 2018
Event18th ACM Internet Measurement Conference 2018 - Northeastern University, Boston, United States
Duration: 31 Oct 20182 Nov 2018
Conference number: 18


Conference18th ACM Internet Measurement Conference 2018
Abbreviated titleACM IMC 2018
Country/TerritoryUnited States
Internet address


  • Authoritative servers
  • Caching
  • DDoS attacks
  • DNS
  • Recursive DNS servers


Dive into the research topics of 'When the dike breaks: Dissecting DNS defenses during DDos'. Together they form a unique fingerprint.

Cite this