Open Resolver Problems

Wed Mar 27 14:46:10 UTC 2013

On 3/27/2013 9:34 AM, William Herrin wrote:
> On Wed, Mar 27, 2013 at 10:00 AM, Jack Bates <jbates at brightok.net> wrote:
>>
>> Tracking the clients would be a huge dataset and be especially complicated
>> in clusters. They'd be better off at detecting actual attack vectors rather
>> than rate limiting.
> I count this among the several reasons I intend to wait until a
> solution has been accepted into the bind mainline.
>
>
You'll also find that it serves little purpose. The only 2 methods for 
stopping DNS amplification to my knowledge are:

1) tcp

2) require all requests to pad out to maximum response

3) BCP38 (in spirit)

The first has latency, load, and connection limitations. It is just too 
expensive.

The second would stop amplification, however, it will not stop botnets 
using them in attempts to hide the bot nodes in a very effective manner. 
It's also unlikely that we'd ever see it implemented.

The only effective fix is still BCP38 (in spirit).

Jack