Sipura VoIP phone adapters and DoS against name servers

Mon Jul 5 16:57:03 UTC 2004

Last night we configured our equipment to reject recursive DNS lookups
from non-customers. This morning, soon after normal office hours began,
we started receiving around 2500 DNS lookups per second more than normal
to our recursive name servers.

After analyzing the DNS lookups, we found that all of the extra traffic
was generated from customers of a local VoIP provider which uses Sipura
(SPA-2000) phone adapters. It seems that when these adapters don't
receive answers to their DNS queries, they will retransmit the query
once per second (until they receive an answer). Multiply by number of
adapters, and you have the recipe for a nice DoS.

Shades of Netgear NTP DoS (http://www.cs.wisc.edu/~plonka/netgear-sntp/)
- don't vendors ever learn?

Steinar Haug, Nethelp consulting, sthaug at nethelp.no