<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
No number of hosts sending packets can exceed 25,000 500 Byte packets<br>to a single 100 MHz 802.3 host. In fact, 802.3 preamble, headers, CRC,<br>and IFG limit the 500 Byte packet rate to below 25K pps. However,<br>multiple attacking hosts could cause excessive link-layer contention<br>
(nothing to do with host or host network interface "interrupts" or<br>"buffers") and so packet losses in either or both directions for<br>legitimate DNS traffic and so the reported effects.</blockquote>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Without data such as packet counts from standard tools such as `netstat`,<br>
my bet is what I said before, that the application fell behind, its socket<br>buffer overflowed, and the results were as seen. However, I would not<br>bet too much, because there are many other places where the DNS requests<br>
or responses could have been lost including:<br> - intentional rate limiting in the DNS server, perhaps even RRL<br> - intentional rate limiting in the kernel such as iptables<br> - intentional rate limiting in a bridge ("hub") in the path<br>
- unintentional link layer rate limiting due to contention for<br> bridge buffers or wires. At full speed from the attacking systems,<br> unrelated cross traffic through hubs in the path or on the wires<br> to DNS server would cause packet losses including losses of valid <br>
<span style="color:rgb(0,0,0)"> answers and so timeouts and so the observed effect.</span></blockquote><div> </div><div>No iptables rules were set; no RRL was applied (when sending bursts to incorrect/closed port - legitimate responses arrived ok). </div>
</div><div class="gmail_extra"><div><br></div><div><div class="gmail_default" style="font-family:tahoma,sans-serif">There are these measurments that studied loss due to traffic volume, and they found that Kernel loss occurs at above 100-150 Kpps (packets per second), with 64 byte packets. One of these works, in addition to measuring loss in kernel, also measured performance of snort under heavy load, and found loss could occur above 100KB. </div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><a href="http://www.sciencedirect.com/science/article/pii/S143484110600063X">http://www.sciencedirect.com/science/article/pii/S143484110600063X</a><br></div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><a href="http://www.sciencedirect.com/science/article/pii/S1084804509001040">http://www.sciencedirect.com/science/article/pii/S1084804509001040</a><br></div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Two significant differences between our and their setting is that they used only a single host that generated the traffic, and the traffic consisted of 64 Byte packets (we used 500Byte packets).</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">In any case, I am curious as to wether the loss occured in DNS software and if increasing the buffers in DNS software can mitigate the problem (I'll run it again to confirm).</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">Thanks.</div><br></div><div><br></div>-- <br><div dir="ltr"><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Best Regards,</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Haya Shulman</span></font></p><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Technische Universität Darmstadt</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">FB Informatik/EC SPRIDE</span></font></p><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Mornewegstr. 30</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">64293 Darmstadt</span></font></p><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Tel. +49 6151 16-75540</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px"><a href="http://www.ec-spride.de" target="_blank">www.ec-spride.de</a></span></font></p></div>
</div></div>