Re: [c-nsp] DNS amplification

[Arturo Servin <arturo.servin () gmail com>]

        Yes, BCP38 is the solution.

        Now, how widely is deployed?

        Someone said in the IEPG session during the IETF86 that 80% of the
service providers had done it?

        This raises two questions for me. One, is it really 80%, how to measure it?

        Second, if it were 80%, how come the 20% makes so much trouble and how
to encourage it to deploy BCP38?

        (well, actually 4 questions :)

Regards,
as

On 3/16/13 7:24 PM, Jon Lewis wrote:
> On Sat, 16 Mar 2013, Robert Joosten wrote:
>
> > Hi,
> >
> > > > Can anyone provide insight into how to defeat DNS amplification
> > > > attacks?
> > > Restrict resolvers to your customer networks.
> >
> > And deploy RPF
>
> uRPF / BCP38 is really the only solution.  Even if we did close all the
> open recursion DNS servers (which is a good idea), the attackers would
> just shift to another protocol/service that provides amplification of
> traffic and can be aimed via spoofed source address packets.  Going
> after DNS is playing whack-a-mole.  DNS is the hip one right now.  It's
> not the only one available.