[dns-operations] dns retries amplify attack

[east chao]

We saw about 6x. Only the first one. Not the follow-ups. We use RRL.

[image: Inline image 2]


On Mon, Oct 24, 2016 at 5:07 AM, Florian Weimer <fweimer at redhat.com> wrote:

> On 10/22/2016 01:05 AM, Doug Porter wrote:
>
>> We saw as much as a 35x increase in queries toward Dyn (as33517)
>> during the attacks (graph attached).  I'm curious what other parties
>> saw.  Do we all need to think harder about preventing a pile on in
>> these scenarios?
>>
>
> I think something similar could be observed when .ORG went dark many years
> ago.  Apparently, it was quite hard to bring it back.
>
> Florian
>
>
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-operations mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20161027/74a2c8db/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 15003 bytes
Desc: not available
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20161027/74a2c8db/attachment.png>