<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
from the PNG graphic below you should be able to tell that this name
server (one of the "rove ip" or "dns changer" replacement dns
servers; the one responsible for what were once rove digital's
chicago properties) has been used for some kind of dns amplification
attacks. input is green, output is blue.<br>
<br>
you should also be able to see that we installed the DNS RRL patches
on these servers at ~2300Z friday.<br>
<br>
see <a class="moz-txt-link-rfc2396E" href="http://www.redbarn.org/dns/ratelimits"><http://www.redbarn.org/dns/ratelimits></a> for the technical
specification, BIND administrator documentation, and BIND 9.8.latest
and 9.9.latest patch files.<br>
<br>
note that the server graphed below is an open recursive, and that we
don't really know how to rate limit these in a way that limits false
positives and false negatives, but we were desperate, so we used:<br>
<br>
rate-limit {<br>
responses-per-second 10;<br>
window 10;<br>
};<br>
<br>
which is higher and deeper than what should be needed for an
authority DNS name server. (DNS RRL is only known-good for dns
authority servers -- so this example is an off-label use or "hail
mary pass" which happens to work out well.)<br>
<br>
we're counting on the fact that nobody is running a home mail server
or web server using these recursive servers -- in other words we
think we're talking only to web browsers. opendns and googledns are
likely way smarter, and we're not (vernon schryver and myself) ready
to certify the current logic for recursive dns servers. you should
put ACL's on your recursive name servers to keep them from being
used from off-network. don't be an open recursive, in other words,
unless you're as smart as opendns and googledns about how to control
abuse.<br>
<br>
here are the graphs. i totally love this.<br>
<br>
paul<br>
<br>
<img src="cid:part1.05050600.03080706@redbarn.org" alt=""><img
src="cid:part2.01060402.06040005@redbarn.org" alt="">
</body>
</html>