<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body text="#000000" bgcolor="#FFFFFF"><br>
<br>
Scott Brynen wrote:
<blockquote
cite="mid:48187E5711D3204C991CB60EC396B754774DF388@VCVANMAILMB1.vci.local"
type="cite">
<pre wrap="">if you're not using the absolute latest bind, you can do a quick and nasty using IPTABLES.</pre>
</blockquote>
<br>
likewise ipfw. however, these would be request-based thresholds, which
has an unacceptably high rate of both false positive and false negative.
i strongly recommend against this approach when protecting remote
victims. iptables and ipfw can be used with very high thresholds (20X
the thresholds used for RRL) in order to protect a name server, but at
that threshold you will do nothing to protect remote victims.<br>
<br>
paul<br>
<br>
re:<br>
<br>
<blockquote
cite="mid:48187E5711D3204C991CB60EC396B754774DF388@VCVANMAILMB1.vci.local"
type="cite">
<pre wrap="">
Basically; if you get more than 12 hits in 75 seconds from the same IP, start dropping them. There are few DNS situations where a client would make that many requests back to back to back, and even if you start denying them, their resolver (if it's real) should just switch over to another NS server.
iptables -A INPUT -p udp -m udp -m recent -i eth0 --dport 53 --update --seconds 75 --hitcount 12 --name DNSTHROTTLE --rsource -j DROP
iptables -A INPUT -p udp -m udp -m recent -i eth0 --dport 53 -j ACCEPT --set --name DNSTHROTTLE --rsource
</pre>
<blockquote type="cite"><blockquote type="cite"><pre wrap="">I recently help close down an open recursive resolver. It is still getting a lot of queries for isc.org/ANY which get a refused response (unless
slipped/dropped by RRL). Granted, this doesn't amplify the attack since REFUSED is a fairly small packet, but it is still traffic to the attacked site.
</pre></blockquote></blockquote>
<pre wrap=""><!---->
_______________________________________________
dns-operations mailing list
<a class="moz-txt-link-abbreviated" href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a>
<a class="moz-txt-link-freetext" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a>
dns-jobs mailing list
<a class="moz-txt-link-freetext" href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a>
</pre>
</blockquote>
</body></html>