Collected research
A Flushing Attack on the DNS Cache
Presents DNS CacheFlush, a denial-of-service attack that thrashes rather than poisons a recursive resolver's cache. Authoritative replies carrying many server names, such as long referral responses or CNAME chains, bypass cache protections and insert records far faster than the attacker queries, evicting benign entries from the LRU cache. A domain queried once per second missed 95.7% of the time under an 8,000 qps attack, and dropping such replies before processing is recommended.
Record
- Researcher
- Yehuda Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt
- Published by
- usenix.org
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Yehuda Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .