[dns-operations] traffic jam

[Roland Dobbins]

On 27 Apr 2015, at 12:13, Randy Bush wrote:

> nominum?  msoft?  so it is backscatter from doses toward them?

Well, if your server is an open recursor through misconfiguration 
(unlikely, I know) or some miscreant fatfingered a list, then maybe.  
Attackers tend to use lots of recursives in reflection/amplification 
attacks with limited numbers of queries for each one, and once you're on 
the list of open recursives, you still get pummeled every so often even 
after remediation/even if you weren't recursive in the first place.

-----------------------------------
Roland Dobbins <rdobbins at arbor.net>