Bugtraq mailing list archives
Re: recursive DNS servers DDoS as a growing DDoS problem
From: Chris Thompson <cet1 () cus cam ac uk>
Date: Tue, 21 Mar 2006 00:01:13 +0000
Michael Sierchio <kudzu () tenebras com> writes:
Robert Story wrote:VG> In the scenario you describe, I cannot see any actual amplification... The amplification isn't in the number of hosts responding, but in packet size. A very small DNS request packet results in a huge response packet.Are you talking about rogue authoritative servers? Otherwise, responses will be limited to 512 bytes, possibly with the truncation bit set.
Unless it supports EDNS, in which case it may be persuaded to send larger replies. BIND does currently have "you cannot be serious" cutoff at 4096 bytes. The reason that it is more awkward to use the method against authoritative-only nameservers is that you have to find a large RRset in the wild (or one that will come with large authority and/or additional sections in the reply) and then use the authoritative nameservers for that RRset, not any old open recursive nameserver (or many of them). You cannot craft your own RRset for the purpose. But you can still get amplification, certainly. -- Chris Thompson Email: cet1 () cam ac uk
Current thread:
- Re: recursive DNS servers DDoS as a growing DDoS problem v9 (Mar 01)
- Message not available
- <Possible follow-ups>
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Mar 02)
- Re: recursive DNS servers DDoS as a growing DDoS problem Ventsislav Genchev (Mar 10)
- Re: recursive DNS servers DDoS as a growing DDoS problem Robert Story (Mar 17)
- Re: recursive DNS servers DDoS as a growing DDoS problem Michael Sierchio (Mar 20)
- Re: recursive DNS servers DDoS as a growing DDoS problem Robert Story (Mar 17)
- Re: recursive DNS servers DDoS as a growing DDoS problem Chris Thompson (Mar 23)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Mar 27)
- Re: recursive DNS servers DDoS as a growing DDoS problem MaddHatter (Mar 25)
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Mar 25)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Mar 27)
- Re: recursive DNS servers DDoS as a growing DDoS problem mike davis (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem gboyce (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem Stephen Samuel (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Mar 25)