Re: recursive DNS servers DDoS as a growing DDoS problem

Michael Sierchio <kudzu@tenebras.com> writes:
> Robert Story wrote:
>
> > VG> In the scenario you describe, I cannot see any actual amplification...
> >
> > The amplification isn't in the number of hosts responding, but in packet 
> > size.
> > A very small DNS request packet results in a huge response packet.
>
> Are you talking about rogue authoritative servers?  Otherwise, responses
> will be limited to 512 bytes, possibly with the truncation bit set.

Unless it supports EDNS, in which case it may be persuaded to send
larger replies. BIND does currently have "you cannot be serious"
cutoff at 4096 bytes.

The reason that it is more awkward to use the method against
authoritative-only nameservers is that you have to find a large
RRset in the wild (or one that will come with large authority and/or
additional sections in the reply) and then use the authoritative 
nameservers for that RRset, not any old open recursive nameserver 
(or many of them). You cannot craft your own RRset for the purpose. 

But you can still get amplification, certainly.

-- 
Chris Thompson
Email: cet1@cam.ac.uk