[dns-operations] Configurable TC=1?
rbabel at babylon.pfm-mainz.de
Mon Dec 21 04:32:00 UTC 2015
Mukund Sivaraman wrote:
> Ralph Babel wrote:
>> is there a nameserver implementation that allows
>> me to respond with a minimal TC=1 packet if ...
>> sizeof(UDP-response) > sizeof(UDP-query) * x + y
>> ..., x and y being fully configurable, preferably
>> on a per-address-range basis, maybe even dependent
>> upon the query type?
> What is possible from having a nameserver
> that supports this arithmetic?
You could make amplification attacks unattractive
by no longer amplifying anything (or by keeping the
possible amplification factor sufficiently small).
> Some nameservers implement an absolute maximum
> message size limit setting [...] that is sufficient
> if one wants to truncate UDP responses above a limit.
Truncating at a fixed upper bound doesn't help, as BPS
amplification obviously depends on the query size as well.
More information about the dns-operations