<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 2012-06-25 7:40 AM, Klaus Darilion
wrote:<br>
</div>
<blockquote cite="mid:4FE81604.6020402@pernau.at" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<br>
<div class="moz-cite-prefix">On 24.06.2012 01:19, Paul Vixie
wrote:<br>
</div>
<blockquote cite="mid:4FE64F07.9010801@redbarn.org" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<br>
<img src="cid:part1.03040209.07010407@redbarn.org" alt=""><img
src="cid:part2.08080000.05070300@redbarn.org" alt=""> <br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
Nice. But I wonder why there is a drop-down of outgoing packets
during an amplification attack. I would expect that outgoing
traffic is constant. Maybe, in this case also legitimate queries
are blocked (false positive).<br>
</blockquote>
<br>
it's hard to see on this graph, but on these servers, the output
rate for valid queries always suffers during an input spike. i don't
see the same depression on authority servers i run elsewhere. i
believe that what's happening is that the recursive servers can't
hear their cache-miss responses which are lost in the storm due to
upstream path congestion. vernon and i are researching this.<br>
<br>
i would very much welcome similar graphs from other people using DNS
RRL in production (or who can test at those input volumes.)<br>
<br>
also: if you are an operator feeling these attacks and you're able
to invest time and energy into helping to track them back, there's a
private ops-t work party ("madmax") that i'd like to invite you
into. let me know.<br>
<br>
paul<br>
</body>
</html>