Towards estimating the untapped potential: a global malicious DDoS mean capacity estimate

What is the malicious reflected distributed denial of service (rDDoS) mean potential of the internet? The authors have been using data from the openNTP project which measures the number of reflectors on the internet since 2014 until now, and completed a graph that roughly estimates a lower boundary for global rDDoS mean potential across four internet protocols (IPs); SSDP, NTP, SNMP and open recursive DNS. By summing these values, and adjusting for average uplink capacity from reflectors, we come to a single number: 108.49 Tb/s as an estimate of rDDoS magnitude potential across IPv4. Tracking this number over time can give us insights into global remediation and clean-up efforts and where to invest our resources in when battling of rDDoS attacks. This paper demonstrates that the upstream throughput is the main contributing, measurable limiting factor for a volumetric rDDoS attack. The largest DDoS event reported by a single target (Dyn in 2016) was 1.2 Tb/s. In contrast, our lower estimate for the global attack potential is two orders of magnitude larger than the Dyn attack.The key contribution is an extensible methodology for measuring global potential for rDDoS attacks, with surprising policy implications.