[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
DNS DoS ???
- Subject: DNS DoS ???
- From: drew.weaver at thenap.com (Drew Weaver)
- Date: Sat, 30 Jul 2011 12:33:14 -0400
- In-reply-to: <[email protected]>
- References: <CACRGtSOSPm12YE3S=n801ooun32VrXsRfP7yqO55kcHMSnss9A@mail.gmail.com> <[email protected]>
-----Original Message-----
From: Dobbins, Roland [mailto:rdobbins at arbor.net]
Sent: Friday, July 29, 2011 6:40 PM
To: NANOG list
Subject: Re: DNS DoS ???
On Jul 30, 2011, at 1:51 AM, Elliot Finley wrote:
> my DNS servers were getting slow so I blocked recursive queries for all but my own network.
This should be the standard practice. By operating an open recursor, you lend your DNS server to abuse as a contributor to DNS reflection/amplification attacks.
-----------------------------------------------------------------------
And at this point he may as well just ACL in-front of the recursors to prevent the traffic from hitting the servers thus reducing load needed to reject the queries on the servers themselves.
-Drew
- References:
- DNS DoS ???
- From: efinley.lists at gmail.com (Elliot Finley)
- DNS DoS ???
- From: rdobbins at arbor.net (Dobbins, Roland)