How much entropy must an off-path DNS forger beat inside one query's lifetime?

## Turning the attack into arithmetic The useful way to think about off-path answer forgery is as a purchase: how much traffic, over how long, buys one accepted forgery? Every term in that sum is knowable, so the question is answerable on a whiteboard. ### The entropy on offer - **Message ID: 16 bits.** Fixed by the protocol header. 65,536 values, and a resolver that picks them with a weak generator effectively has fewer. - **Source port: 14 to 16 bits in practice.** A resolver that randomises the ephemeral port per query draws from a range of tens of thousands of ports — roughly 2^14 to 2^16 depending on the range configured. Historically resolvers bound one socket and used a single port for their entire uptime, which reduced this term to zero and is exactly why per-query randomisation became the baseline recommendation. - **Which server was asked.** A zone typically publishes two to six authoritative nameservers. The resolver picks one, often by measured responsiveness, and the forged packet's source address must match that choice — a couple of bits, or a couple of times more traffic if the attacker sprays all of them. - **Question-name case, where used.** Random capitalisation of the queried name, echoed verbatim by a compliant server, adds roughly one bit per letter, but only against servers that preserve case. Multiply the first two and you get the number everyone quotes: about 2^32, four billion combinations, in the good case; nearer 2^30 with a narrow ephemeral range. ### The window The race is not open-ended. It runs from the moment the resolver emits its query to the moment the genuine reply arrives and retires the outstanding state. For an authoritative server a continent away that is perhaps 100 to 200 ms; for a nearby one it can be 20 ms. A shorter round-trip is a *smaller* target for the attacker, which is a slightly counter-intuitive consequence: a fast, well-connected zone is harder to race than a slow one. ### The per-race odds A minimal forged DNS response for a short name is on the order of 100 bytes on the wire including link, IP and UDP overhead. One gigabit per second is therefore roughly a million packets per second — call it 100,000 distinct guesses inside a 100 ms window, assuming the attacker never repeats a guess and can actually sustain line rate at the target. With N combinations and n distinct guesses landed inside the window, the chance of success in one race is about n/N. Here that is 100,000 / 4,300,000,000, or roughly one in forty thousand. Ten gigabits improves it to about one in four thousand. Expected races before a hit is N/n — tens of thousands, in the good case. ### Why the binding constraint is attempts, not bandwidth This is the part candidates miss. Bandwidth only fills one window. To fire another shot the attacker needs the resolver to have another query for that name in flight — and after a successful legitimate lookup the resolver serves its own copy instead of asking again, so a naive attacker is throttled to one attempt per expiry of the record. At one attempt per record lifetime, tens of thousands of attempts is not hours, it is years. The constructions that made this attack famous are precisely the ones that break that throttle by getting the resolver to keep asking, and they are what turned an implausible race into a practical one. So the honest budget line reads: *sustained multi-gigabit traffic at a specific resolver, held for hours, plus a reliable way to force repeated lookups, plus the target resolver not de-randomising anything, plus nobody noticing hours of spoofed-source flood.* That is not free, and it is not stealthy. ### Where the entropy quietly collapses The arithmetic assumes the randomness survives the path, and sometimes it does not: - A NAT device or middlebox between the resolver and the internet may rewrite the source port into a small or sequential range, destroying most of the port entropy no matter what the resolver chose. - A stub or branch resolver that forwards everything to an upstream may reuse a single socket, so the port term goes to zero on that hop. - A weak ID generator with a predictable sequence turns 16 bits into a handful. When one of those holds, the real N is nearer 2^16 than 2^32, and 100,000 guesses in one window is no longer a lottery ticket — it is a near certainty. That is why the correct answer to "how much entropy" is always "how much *actually reaches the wire*", not "how much the software intended". ### The comparison that finishes the answer Having priced the race in gigabit-hours, the follow-through is to notice what that money buys elsewhere. The objective is not to win a race; it is to be believed as the authority for a name. Changing the delegation at the registry achieves that permanently, for every resolver in the world, with no packets and no entropy — which is why this arithmetic, done honestly, usually argues *against* the technique rather than for it.