mailing list archives
Re: recursive DNS servers DDoS as a growing DDoS problem
From: Jim Pingle <jim () hpcisp com>
Date: Tue, 04 Apr 2006 18:09:02 -0400
We have done just this (block inbound udp/53) to certain subnets due to a
rash of CPEs that happily proxy DNS, including recursive queries,
from their WAN side.
What devices? Is this a default or something customers are configuring?
Just about every Siemens/Efficient *DSL router (5851, 5871, 5890, some
others) I have seen does this by default. During one attack I logged into a
router and changed the DNS servers used for DHCP from both, to one, to the
other, and watched its traffic flow exactly where I pointed the DNS servers.
These routers also have a bad habit of hijacking DNS requests for anything
in the form of <routername>.anydomain.com. Even if the DNS request is sent
to an ISP name server, it will still return a record pointing to its own LAN
IP when queried for, i.e. foo.bork.com and foo.microsoft.com if you named
the router "foo".
It's not only done by default, it's not a configurable behavior as far as
I've been able to find. The fix we were supplied with was to block inbound
udp/53 using the router's internal IP filtering, and to name the router
something unique (i.e. a customer's order number).
Re: recursive DNS servers DDoS as a growing DDoS problem Simon Boulet (Apr 05)