In this deep dive, we'll break down the technical mechanics of the attack, explain why a shiny edge firewall can't save you on its own, and show how we swung the axe using BGP Blackholing to keep the rest of our network alive 🤗.

The Mechanics : Reflection, Spoofing, and the Lever Effect

A DNS amplification attack relies on a lethal combination of two internet design flaws: the stateless nature of UDP (no source validation by default) and misconfigured open DNS resolvers.

DNS AMPLIFICATION

DNS AMPLIFICATION

Step 1: IP Spoofing (The Reflection) 

Unlike TCP, which requires a full three-way handshake (SYN -> SYN-ACK -> ACK), UDP is a stateless, "fire-and-forget" protocol.

An attacker crafts a UDP packet aimed at a public DNS resolver, but lies in the packet header : they swap their real source IP with the public IP address of our server. The DNS resolver, being polite but naive, processes the request and sends the answer straight to the victim.

Step 2: Amplification (The Leverage)

Here is where the math gets brutal:

  1. The attacker sends a tiny query: qtype=ANY (or TXT / DNSKEY) with the EDNS0 extension enabled. This basically tells the resolver: "Give me EVERYTHING you have on this domain, and feel free to breach the traditional 512-byte UDP limit."
  2. The initial forged query weighs roughly 60 to 70 bytes.
  3. The resolver's response stuffed with DNSSEC keys, RRSIGs, TXT records, and address records—can easily reach 3,000 to 4,000 bytes.

With a typical multiplier of 50x to 70x, an attacker generating a modest 100 Mbps stream of queries from a small botnet converts it into a staggering 5 Gbps to 7 Gbps wall of traffic crashing into the target.

The Magic Firewall Myth : Why the Fortinet Got Overwhelmed

Whenever a massive DDoS attack hits, there’s a common reflex in IT management and security teams: "Wait, why didn't our Firewall block this ? "

It’s a fair question, but it stems from a fundamental misunderstanding of where volumetric attacks do their damage. To understand why a firewall turns into a spectator during a massive reflection attack, we have to look at the difference between processing capacity and physical bandwidth capacity.

 If the attacker generates 15 Gbps of UDP response traffic and your ISP transit circuit or edge router interface maxes out at 10 Gbps, the bottleneck occurs at the upstream interface buffer, long before photons ever hit the Fortinet’s WAN port.

When an incoming physical interface on an edge router receives more bits per second than its serializer can push across the wire, its hardware queues (buffers) fill up instantly. Once those queues are 100% full, the router triggers Tail Drop:

  • The router blindly drops every single packet that arrives past the buffer threshold.
  • It doesn't care if a packet is an attack response, a legitimate HTTP GET request from a real client, or an SSH session packet.
  • Because UDP has no built-in congestion control, the attack packets keep flooding in relentlessly, occupying 99% of the buffer space and starving legitimate TCP traffic (which backs off due to TCP congestion control algorithms, making the situation even worse!).

The firewall can only protect what it actually receives. When an attack exceeds the physical transit link capacity of the network, filtering at the firewall level is mathematically useless. We don't have a security policy problem we have a traffic routing and capacity problem.


DNS Amplification VS Our Network Architecture

DNS Amplification VS Our Network Architecture