https://nalar.dev/tags/ddos/ Recent content in DDoS on Nalar Hugo en-us Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/dns-cookies-limit-off-path-dns-amplification-and-forgery/ Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/dns-cookies-limit-off-path-dns-amplification-and-forgery/ <p>UDP makes DNS efficient, but its source address can be forged by an off-path sender. A small query carrying a victim&rsquo;s address can trigger a larger response toward that victim, creating reflection and amplification. Forged replies also matter to resolvers because an attacker may try to inject an answer before the legitimate response arrives.</p> <p>DNS Cookies add a lightweight transaction token to this boundary. RFC 7873 defines the COOKIE EDNS option, while RFC 9018 updates the server-side construction so implementations can interoperate, including in multi-vendor anycast deployments. The mechanism is deliberately limited: it raises the cost of off-path forgery, but it is not encryption, DNS data authentication, or protection from an adversary that can observe traffic on path.</p>