Home page logo

bugtraq logo Bugtraq mailing list archives

Re: recursive DNS servers DDoS as a growing DDoS problem
From: "Geo." <geoincidents () nls net>
Date: Sun, 2 Apr 2006 10:31:07 -0400

1. Resolvers and Authoritative nameservers must be separate and
authoritative nameservers must have recursion turned off. Otherwise
there is no way to throttle only recursive queries.

Great, for small ISP's you just doubled the number of machines they need to
dedicate to DNS.

2. In a smaller ISP the nameservers themselves can get an aggregate of
the ISP routing table and have internal routes tagged accordingly so
that the DNS server can throttle them. No rocket science there, the
provisions are already available in every single OS in use as a DNS
server in ISPs/Telcos. All this requires is a moderate level of
competence in the person who has designed the service.

Really? Ok educate me, how do you do this with Windows 2000 running MS dns?
(telling people to use another server is not acceptable)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]