![nanog logo](/images/nanog-logo.png)
nanog mailing list archives
Re: Interesting new dns failures
From: David Ulevitch <davidu () everydns net>
Date: Tue, 22 May 2007 15:02:22 -0700
Fergie wrote:
David, As you (and some others) may be aware, that's an approach that we (Trend Micro) took a while back, but we got a lot (that's an understatement) of push-back from service providers, specifically, because they're not very inclined to change out their infrastructure (in this case, their recursive DNS) for something that could identify these types of behaviors.
Was that the real reason? Here's a crazy question... Did it by chance cost money? :-)I'm not saying it should have been free just that the hesitation to roll it out *might* have been for factors besides the fact that it mitigated DNS based botnets.
How do operators decide the expense is worth it to mitigate spew coming out of their network? When their outbound DoS traffic exceeds their inbound transit ratios? :-)
-David
And actually, in the case you mentioned above -- to identify this exact specific behavior.
Current thread:
- OK - functioning administration of 44.0.0.0/8, (continued)
- OK - functioning administration of 44.0.0.0/8 Neal R (May 21)
- Re: OK - functioning administration of 44.0.0.0/8 Harald Koch (May 21)
- Re: Use of portions of 44.0.0.0/8? Joel Jaeggli (May 21)
- Re: Interesting new dns failures Fergie (May 20)
- Re: Interesting new dns failures Fergie (May 20)
- Re: Interesting new dns failures John Curran (May 21)
- Re: Interesting new dns failures Fergie (May 21)
- Re: Interesting new dns failures Chris L. Morrow (May 21)
- Re: Interesting new dns failures Fergie (May 21)
- Re: Interesting new dns failures Fergie (May 22)
- Re: Interesting new dns failures David Ulevitch (May 22)
- Re: Interesting new dns failures Chris L. Morrow (May 22)
- Re: Interesting new dns failures David Ulevitch (May 22)
- Re: Interesting new dns failures Fergie (May 22)
- Re: Interesting new dns failures Fergie (May 24)
- Re: Interesting new dns failures Chris L. Morrow (May 24)
- Re: Interesting new dns failures Roger Marquis (May 24)
- Re: Interesting new dns failures John Levine (May 24)
- Re: Interesting new dns failures Per Heldal (May 25)
- Re: Interesting new dns failures Simon Waters (May 25)
- Re: Interesting new dns failures Chris L. Morrow (May 24)
- Re: Interesting new dns failures John Levine (May 24)