TechKnowSurge
TechKnowSurge Catalog Videos DEMO: DNS Flood Attack
VideoSecurityFree

DEMO: DNS Flood Attack

A DNS flood attack overwhelms a target by sending massive volumes of UDP traffic to port 53, preventing the server from responding to legitimate DNS requests. It can use actual DNS queries, ICMP packets, or amplified traffic to achieve denial of service.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A DNS flood attack is a category of UDP flood attack specifically aimed at port 53, the port responsible for DNS resolution. By sending an overwhelming volume of traffic to this port, an attacker renders the target server unable to process legitimate DNS queries, effectively taking it offline from the perspective of normal users. The traffic used in this attack does not have to consist of valid DNS packets — ICMP packets directed at port 53 are also sufficient to produce the denial-of-service effect, making the attack flexible in its execution. Attackers can also leverage amplification techniques, where a relatively small request generates a disproportionately large response, magnifying the impact on the target. Tools like hping3, available natively on Kali Linux, allow security professionals to replicate this attack in controlled lab environments using randomized source IP addresses to simulate distributed traffic patterns. Understanding how DNS flood attacks are constructed and executed is essential knowledge for network defenders, penetration testers, and anyone responsible for protecting DNS infrastructure.

What you'll learn

What's covered

DNS Flood Attack

Key terms

Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
User Datagram Protocol
UDP
A connectionless transport protocol that sends data without establishing a connection or guaranteeing delivery.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
DNS Flood Attack
A type of UDP flood attack that overwhelms a target on port 53 with DNS queries or ICMP packets, preventing the server from responding to legitimate DNS requests.

Topics

Dns Ddos Udp Dns Flood Attack Network Security Traffic Amplification

Transcript

Let's now take a look at a DNS flood attack. The name really says it all.

What a DNS Flood Attack Is

A DNS flood attack just means that it's sending a bunch of packets over trying to overwhelm the machine so that it can't respond to legitimate traffic. Really, what's being targeted is this UDP port 53. So, first of all, it's a UDP, so it is a type of UDP flood attack. A DNS flood attack is a type of UDP flood attack. Then we also see it's hitting port 53.

So this means that it could be whatever we're hitting port 53 with. It could be with some sort of DNS packet that's requesting a DNS server, or it could just be ICMP packets that are hitting port 53.

I'm going to show you a version of this UDP flood attack, but remember, this is for ethical hacking purposes only. Only do this on equipment that you own and networks that you own, or equipment and networks that you've gotten permission to carry out this type of attack with.

Carrying Out the Attack

I'm on a Kali Linux box, and what we're going to do is open up a terminal and use our hping to do a flood attack here. I'm going to make this a little bit bigger so we can see this better. We're going to use our sudo command, and we're going to do hping3. We've got to have a target machine, so what we're going to target is 10.130.23; that's going to be our target machine.

We're going to do this from all sorts of random sources, so that's going to be from all sorts of IP addresses that are varying. We're going to do a flood attack; that's the type of attack we're going to do. This is going to be a DNS one. So we're going to do — oop, I need a dash dash — it's a UDP packet. And we're targeting the destination port of 53.

So we're going to carry this out. I'm going to hit enter. It does need a password. All right, and now it's carrying out this type of attack, and it's flooding it with this type of attack.

How It Works

So in this case, we're using an ICMP packet to hit this port 53, and it's still considered a DNS flood attack. But these wouldn't necessarily have to be ICMP packets. They could actually be DNS queries. So we're sending DNS queries over to the machine, and that would work as a DNS flood attack as well, depending on the query type. It also could be an amplification attack, something where the request that's being made gets amplified.

So, with a DNS flood attack, we're essentially overwhelming the victim machine with requests or ICMP packets hitting port 53, overwhelming whatever machine that we're hitting. Therefore, it can't resolve, or can't service legitimate users.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →