<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
in DNSPod, we responded user a random cname like afda7896.dnspod.com to prevent DNS query flood and avoid TCP issue.</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_sign_1391792879089364992" class="bloop_sign">
<div style="font-family:helvetica,arial;font-size:13px">
<div>Kind regards</div>
<div>-- </div>
<div>DNSPod - make your domain intelligent</div>
<div><br>
</div>
<div>Sam Wu</div>
<div>Founder & CEO</div>
<div><br>
</div>
<div>E-Mail: samwu@dnspod.com</div>
<div>http://www.dnspod.cn</div>
<div>地址: 山东省烟台市开发区长江路28号华新国际大厦1210室 264006</div>
<div>Addr: #1210 HuaXin Intl. Bldg., #28 ChangJiang Rd., Development Dist., YanTai City, ShanDong Prov., China</div>
</div>
</div>
<div style="color:gray">
<hr style="style:linear">
From: <span style="color:black">Colm MacCárthaigh</span> <a href="mailto:colm@stdlib.net">
Colm MacCárthaigh</a><br>
Date: <span style="color:black">February 8, 2014 at 1:03:03 AM</span><br>
To: <span style="color:black">Tony Finch</span> <a href="mailto:dot@dotat.at">dot@dotat.at</a><br>
Subject: <span style="color:black"> Re: [dns-operations] rate-limiting state(Internet mail)
<br>
</span></div>
<blockquote type="cite" class="clean_bq"><span>
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On Fri, Feb 7, 2014 at 6:16 AM, Tony Finch <span dir="ltr">
<<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="">What not just the victim? In the absence of RRL the DDoS attack is likely<br>
</div>
to cause collateral damage, yes. In the presence of RRL non-victims are<br>
unaffected as long as the attack isn't overwhelming the name server.<br>
</blockquote>
<div><br>
</div>
<div>Both can cause collateral damage, but to different targets. RRL does reduce the collateral damage to a reflection target. But it also increases the collateral damage to your legitimate users. If an attacker spoofs a popular resolver, then for just 5-10
queries per second they cause a degradation in service to the real legitimate users of that resolver. With the default settings, 12.5% of queries from that resolver may not get any answer at all, even with three attempts, and the lookup time is increased by
about 1.3 RTTs on average. With the resolver trying 3 authoritative nameservers, the availability hit diminishes to about 0.2% (which brings us to two nines), but the RTT hit gets worse. </div>
<div><br>
</div>
<div>Now if I have a botnet or client that can generate 1M PPS (this is small, but adjust to any number), I can try to spoof 66,666 popular resolvers (this is a knowable set) at 5 QPS each to 3 auth servers, I can use RRL to degrade service in a more widespread
way. </div>
<div><br>
</div>
<div>Now, let's say you have the capacity to answer these queries (which is realistic for some) which behavior is better for your users? Just answering the responses? Or rate-limiting the responses? </div>
<div><br>
</div>
<div>My overall point is that with RRL there is some trade-off between protecting innocent reflection victims and opening yourself to an attack that degrade service to your real users in some way. Were RRL to be widely deployed, attacks could shift to table-exhaustion
and popular-resolver spoofing and be effective in different ways. </div>
</div>
<div><br>
</div>
-- <br>
Colm </div>
</div>
</div>
</span></blockquote>
</body>
</html>