bugtraq - Re: recursive DNS servers DDoS as a growing DDoS problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 2 Apr 2006 10:31:07 -0400
From: "Geo." <geoincidents@....net>
To: <bugtraq@...urityfocus.com>
Subject: Re: recursive DNS servers DDoS as a growing DDoS problem


> 1. Resolvers and Authoritative nameservers must be separate and
> authoritative nameservers must have recursion turned off. Otherwise
> there is no way to throttle only recursive queries.

Great, for small ISP's you just doubled the number of machines they need to
dedicate to DNS.

> 2. In a smaller ISP the nameservers themselves can get an aggregate of
> the ISP routing table and have internal routes tagged accordingly so
> that the DNS server can throttle them. No rocket science there, the
> provisions are already available in every single OS in use as a DNS
> server in ISPs/Telcos. All this requires is a moderate level of
> competence in the person who has designed the service.

Really? Ok educate me, how do you do this with Windows 2000 running MS dns?
(telling people to use another server is not acceptable)

Geo.