[dns-operations] Continued weekly DDoS fun

[Roland Dobbins]

On Jan 12, 2009, at 4:33 PM, Tom Daly wrote:

> Our normal countermeasures are holding this back no problem, but the  
> frequency is getting pretty annoying. Is anyone else seeing anything  
> similar? Anyone have any more advanced mitigation techniques then  
> the good old 'find and filter' cat and mouse game?

There are commercial DDoS mitigation products available from various  
vendors which specifically help mitigate DDoS against DNS (full  
disclosure:  my employer, Cisco Systems, is one such vendor).

There are also commercial DDoS mitigation services based upon these  
technologies, known as 'Clean Pipes' services, which provide this type  
of mitigation for a fee.

I'm unsure if either of these options is viable for dyndns.org;  
otherwise, S/RTBH is a common  reaction/mitigation tool utilized by  
SPs to mitigate DDoS in general (usual cautions about being gamed into  
blocking non-attacking nodes/networks whose addresses are being  
spoofed applies).

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at cisco.com> // +852.9133.2844 mobile

      All behavior is economic in motivation and/or consequence.