RE: Above.net problems ??

[Sean Donelan <sean () donelan com>]

On Wed, 26 Nov 2003, Arjan Hulsebos wrote:
> The Netherlands were hit as well. We saw a massive flood of queries for
> lockup.zonelabs.com, too. It performed a nice DoS on our client name
> servers.... :-(
>
> You'd think that an unresponsive nameserver would be flagged dead, and such
> information be cached. Does anyone know whether that's actually done in Bind
> 8.3.4? Or perhaps not by default?

BIND9 does this, but it won't prevent clients from still asking the
question over and over again.  So an ISP with lots of downstream dumb
clients (i.e. Windows) will still experience the DOS unless they have
sufficient capacity in their DNS servers or rate-limit tcp/udp 53 at
their network edge.

client -> caching name server -> authoritative name server