Bugtraq mailing list archives
Re: recursive DNS servers DDoS as a growing DDoS problem
From: Anton Ivanov <arivanov () sigsegv cx>
Date: Tue, 04 Apr 2006 07:59:58 +0100
Geo. wrote:
1. Resolvers and Authoritative nameservers must be separate and authoritative nameservers must have recursion turned off. Otherwise there is no way to throttle only recursive queries.Great, for small ISP's you just doubled the number of machines they need to dedicate to DNS.
Not really. If the ISP admin has a clue he would be running two processes off different alias addresses (best of all loopback aliases). This approach is described in most papers on DNS admin and best practice. Otherwise, you are correct for the case where the admin is illiterate and cannot read or does not bother reading. He/she will need two machines indeed.
2. In a smaller ISP the nameservers themselves can get an aggregate of the ISP routing table and have internal routes tagged accordingly so that the DNS server can throttle them. No rocket science there, the provisions are already available in every single OS in use as a DNS server in ISPs/Telcos. All this requires is a moderate level of competence in the person who has designed the service.Really? Ok educate me, how do you do this with Windows 2000 running MS dns? (telling people to use another server is not acceptable)
In an ISP or Telco? Not acceptable - well not really... ;-) Not realistic - hell yeah... In any case in an ISP there will be a cisco (or equivalent) in front of it where the same can be achieved in 5-10 lines worh of config. Cheers, -- A. R. Ivanov E-mail: aivanov () sigsegv cx WWW: http://www.sigsegv.cx/ pub 1024D/DDE5E715 2002-03-03 Anton R. Ivanov <ai1-n () sigsegv cx> Fingerprint: C824 CBD7 EE4B D7F8 5331 89D5 FCDA 572E DDE5 E715
Current thread:
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Apr 01)
- <Possible follow-ups>
- RE: recursive DNS servers DDoS as a growing DDoS problem gboyce (Apr 01)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Jim Pingle (Apr 04)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Jim Pingle (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Erwan David (Apr 09)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Ross Wheeler (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 09)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 04)