What Type of DDoS Attack Uses Spoofed Source IP on DNS Port 53?
A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?
Quick Answer
The answer is a DNS amplification attack, which is the correct choice because it exploits open DNS resolvers to flood a target with large UDP responses sent to port 53, using a spoofed source IP that matches the victim’s address. This works by sending a small query with a spoofed source to many DNS servers, which then reply with much larger responses, amplifying the traffic volume dramatically. On the Certified Ethical Hacker CEH exam, this question tests your understanding of DDoS attack vectors and the abuse of UDP’s connectionless nature, often appearing in scenarios where you must distinguish amplification from reflection or simple flooding. A common trap is confusing it with a SYN flood, but remember that DNS amplification specifically relies on UDP, port 53, and the spoofed source IP of the target. For a memory tip, think “UDP 53 spoof = amplify the boom,” linking the protocol, port, and spoofed address to the traffic multiplication effect.
⚠ Common exam trap
Test-takers frequently confuse a DNS amplification attack with a simple UDP flood, missing the critical clues of spoofed source IP and the specific use of DNS port 53, which indicate the amplification vector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification
This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to multiple DNS servers, which then send large responses to the victim, overwhelming its DNS port (53). The key indicators are the use of UDP, port 53, spoofed source IP of the target, and the amplification effect where a small query generates a much larger response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS amplification
Why this is correct
Attackers send small queries with spoofed source IP to open DNS resolvers, which reply with large responses to the victim.
- ✗
UDP flood
Why it's wrong here
UDP flood directly floods target with UDP packets, but here the packets are from DNS resolvers and spoofed.
- ✗
SYN flood
Why it's wrong here
SYN flood uses TCP SYN packets, not UDP.
- ✗
ICMP flood
Why it's wrong here
ICMP flood uses ICMP echo requests, not UDP.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization's security team observes a surge in outgoing DNS queries to external servers from a single internal host, with each query returning unusually large responses (e.g., 4000 bytes). The host is not configured as a DNS resolver. Which attack is MOST likely occurring?
hard- A.DNS cache poisoning
- B.DNS zone transfer
- C.DNS amplification DDoS attack
- ✓ D.DNS tunneling
Why D: The scenario describes a single internal host initiating a surge of outgoing DNS queries to external servers and receiving unusually large responses (e.g., 4000 bytes). This behavior, particularly from a host not configured as a DNS resolver, is a strong indicator of DNS tunneling. In DNS tunneling, a compromised host establishes a covert communication channel by encapsulating data within DNS queries and responses, often for data exfiltration or command and control. Large DNS responses, frequently utilizing record types like TXT, are commonly employed to transfer significant amounts of data back to the compromised host. DNS amplification DDoS attacks, in contrast, involve an attacker spoofing a victim's IP address to send small queries to open resolvers, causing the victim to be overwhelmed by large, unsolicited responses; the victim does not actively send the initial queries in this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.