nanog mailing list archives

Re: really nasty attacks

From: Stephane Bortzmeyer <bortzmeyer () nic fr>
Date: Thu, 27 Sep 2012 20:26:04 +0200

On Thu, Sep 27, 2012 at 12:12:50PM -0400,
 Patrick W. Gilmore <patrick () ianai net> wrote 
 a message of 32 lines which said:

I do not know of any name servers that reply to queries with UDP
packets filled with only the letter X.  The DNS Headers alone
require more than the letter "X".


Yes, you're right but I'm not sure we should take the original report
too litterally. May be he meant there were a lot of X in the packets
(and he missed the headers), which is consistent with DNS "large TXT"
attacks such as the one described in
<http://technet.microsoft.com/en-us/security/hh972393.aspx> (where the
attacker filled with consecutive numbers, not X).

Anyway, without the actual pcap file, it is only speculation.

Current thread:

Re: guys != gender neutral, (continued)
- - - Re: guys != gender neutral Tim Franklin (Sep 28)
    - Re: guys != gender neutral Randy Bush (Sep 28)
    - Re: guys != gender neutral Owen DeLong (Sep 28)
    - Re: guys != gender neutral Valdis . Kletnieks (Sep 28)
    - RE: guys != gender neutral Otis L. Surratt, Jr. (Sep 28)
    - RE: guys != gender neutral Jamie Bowden (Sep 28)
    - Re: guys != gender neutral Jay Ashworth (Sep 28)
    - Re: guys != gender neutral Justin M. Streiner (Sep 28)
    - RE: guys != gender neutral Keith Medcalf (Sep 29)
    - Re: guys != gender neutral Owen DeLong (Sep 30)
    - Re: really nasty attacks Stephane Bortzmeyer (Sep 27)
    - Re: really nasty attacks Miguel Mata (Sep 27)
    - Re: really nasty attacks Cutler James R (Sep 27)