<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.9">
</HEAD>
<BODY>
On Sun, 2009-01-25 at 08:45, Stephane Bortzmeyer wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#8b6914"><I>On Sun, Jan 25, 2009 at 08:39:27AM +1000,
Noel Butler <noel.butler@ausics.net> wrote
a message of 65 lines which said:
> iptables -A INPUT -p udp --dport 53 -m u32 --u32
> "0>>22&0x3C@12>>16=1&&0>>22&0x3C@20>>24=0&&0>>22&0x3C@21=0x00020001" -j
> DROP
Cute :-) I hesitate to deploy a trick that I have trouble to
verify. Isn't it better to just follow the recommendations in
<</FONT><A HREF="https://www.dns-oarc.net/oarc/articles/upward-referrals-considered-harmful"><U>https://www.dns-oarc.net/oarc/articles/upward-referrals-considered-harmful</U></A><FONT COLOR="#8b6914">>?</I></FONT></PRE>
</BLOCKQUOTE>
<BR>
No, that advice is outright wrong! Contributing to the DDoS, (although we should have all be doing it anyway in general) because you are sending the REFUSED pkt back to the victim, so they are essentially telling you how to participate in the DDoS.<BR>
<BR>
extract " Then, a query such as ". IN NS" should result in a REFUSED response."<BR>
<BR>
It's also no longer just ISPrime thats the victim, I am seeing other targets for past 24 hours.<BR>
<BR>
<BR>
</BODY>
</HTML>