DNS was Re: Internet Vulnerabilities
Paul Vixie
paul at vix.com
Fri Jul 5 17:15:26 UTC 2002
> ... beyond that, security and anycast don't mix well without the data
> being authenticated, e.g. dnssec.
i won't disagree. anycast's cost:benefit analysis is compellingly against
its use in most situations. root name service may be one of them. now, if
the ops community can figure out a way to secure the edge->core boundary
such that packets heard by a DDoS victim will have reasonable IP source
addresses, then that would be better overall. however, in the 36 hours
since i last cleared the ipfw stats on c.root-servers.net, i see:
packets bytes rule
938231392 60808555788 pipe 1 udp from any to any 53 in
48248328 2919355408 deny ip from 192.168.0.0/16 to any in
34199691 2254707782 deny ip from 10.0.0.0/8 to any in
16030262 1061648337 deny ip from 172.16.0.0/12 to any in
and so i don't see much chance that IP source addresses will be believable
any time during the working lives of anyone now reading this. i also think
the likelihood of wide scale dnssec deployment within the next year or two
is two orders of magnitude lower than the likelihood of a DDoS against the
root server system. "more later."
More information about the NANOG
mailing list