<html><head></head><body>Yes! In fact 1:1 at the packet level is enough for effective ddos, even if it's attenuative at the octet level.<br>
<br>
This is why DNS RRL attenuates at both the packet and octet levels.<br>
<br>
The proponents of blocking ANY have not modeled the attackers' goals, nor their alternatives.<br>
<br>
Blocking ANY is silly.<br>
<br>
Vixie<br><br><div class="gmail_quote">On September 3, 2016 10:07:24 AM PDT, Roland Dobbins <rdobbins@arbor.net> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail"><br />On 3 Sep 2016, at 23:30, Shane Kerr wrote:<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Setting "minimal-responses" in BIND 9's named.conf should fix this.<br /></blockquote><br />Paul's real point is that just about any (heh) DNS record can be used <br />for some degree of reflection/amplification.<br /><br />A corollary is that most reflection/amplification attacks - in point of <br />fact, most DDoS attacks in general - are gratuitous examples of <br />overkill. 1:1 reflection alone would meet the obfuscatory needs of most <br />attackers and still get the job done conformant to requirements.<br /><br /><hr /><br />Roland Dobbins <rdobbins@arbor.net><br /><hr /><br />dns-operations mailing list<br />dns-operations@lists.dns-oarc.net<br /><a
href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br />dns-operations mailing list<br /><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>