Bugtraq mailing list archives
RE: recursive DNS servers DDoS as a growing DDoS problem
From: "Thomas Guyot-Sionnest" <Thomas () zango com>
Date: Tue, 4 Apr 2006 07:40:01 -0700
-----Original Message----- From: Geo. [mailto:geoincidents () nls net] Sent: April 2, 2006 10:31 To: bugtraq () securityfocus com Subject: Re: recursive DNS servers DDoS as a growing DDoS problem1. Resolvers and Authoritative nameservers must be separate and authoritative nameservers must have recursion turned off. Otherwise there is no way to throttle only recursive queries.Great, for small ISP's you just doubled the number of machines they need to dedicate to DNS.
They can run both recursive and authoritative DNS on the same server using different IP address.
2. In a smaller ISP the nameservers themselves can get anaggregate ofthe ISP routing table and have internal routes tagged accordingly so that the DNS server can throttle them. No rocket science there, the provisions are already available in every single OS in use as a DNS server in ISPs/Telcos. All this requires is a moderate level of competence in the person who has designed the service.Really? Ok educate me, how do you do this with Windows 2000 running MS dns? (telling people to use another server is not acceptable) Geo.
If Microsoft's products are broken, why souldn't I tell people to use something else? Thomas
Attachment:
smime.p7s
Description:
Current thread:
- Re: recursive DNS servers DDoS as a growing DDoS problem, (continued)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Ross Wheeler (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 09)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 09)