DoS

UDP DNS is stateful in practice: recursive resolvers hold per-query client tables, delegation chain depth counters, DNSSEC validation state, and TCP connection pools for DoT/DoH. Each layer is exhaustible at different cost ratios. Water torture generates maximum valid NXDOMAIN workload at minimum bandwidth. NXNS amplification (CVE-2020-8616) forces resolver delegation storms via NS referrals. TsuNAME creates infinite cyclic delegation. NRDelegation combines both. Full BIND9/Unbound configuration hardening and rate-limiting defense included.

The ‘65536 port limit’ framing is wrong — Linux TCP capacity is governed by 4-tuple uniqueness (src_ip:src_port:dst_ip:dst_port) and ip_conntrack_max. TIME_WAIT exhaustion holds sockets in 2MSL timeout, consuming conntrack entries. Sockstress sets TCP window=0 to trigger infinite Persist Timer loops, stalling server state machines with minimal bandwidth. Slowloris-class variants do the same at L7. Full kernel parameter analysis: tcp_tw_reuse, tcp_fin_timeout, conntrack_max, and per-attack mitigation.