[dns-operations] DNS ANY record queries - Reflection Attacks

Tue Sep 11 05:45:34 UTC 2012

On Mon, Sep 10, 2012 at 11:52:34PM -0400, Robert Schwartz wrote:
> target host. Most of the target hosts seem to be in Asia, just like those
> mentioned in the Sans post.
> The question I have for you all is: Is this something affecting other
> operators? How have you been dealing with it?

We're using the bind rate-limit patches to deal with it. One of our hosts gets 40.000 qps of this crap. It started a few month ago with about 2000 qps mostly from chinese adress ranges.