Home page logo

nanog logo nanog mailing list archives

Re: DNS Amplification attack?
From: jay () miscreant org
Date: Wed, 21 Jan 2009 14:25:49 +1100

Quoting Chris Adams <cmadams () hiwaay net>:

Once upon a time, jay () miscreant org <jay () miscreant org> said:
I've also noticed that on a server running BIND 9.3.4-P1 with
recursion disabled, they're still appear to be getting the list of
root NS's from cache, which is a 272-byte response to a 61-byte
request, which by my definition is an amplification.

Add "additional-from-cache no;" to the options{} section of your
Chris Adams <cmadams () hiwaay net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

Thanks for the response Chris.

I'm running higher versions of BIND, so don't see this behaviour. But I will pass it on to the ISP in question ;)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]