Hi,
We occasionally see DDoS directed at our broadband subscribers and
the most popular of these appear to be dns amplification/dns spoof
based. To protect the network we have implemented some rate limiting so
that udp port 53 traffic from any host to our subscribers is limited to
a maximum of 15mbps. This works for our needs, but we'd like to get a
little more specific and exclude our own resolvers from this limit.
Here's what we have currently:
interface GigabitEthernet0/0.xx
encapsulation dot1Q xx
ip address x.x.x.x y.y.y.y
ip flow ingress
ip flow egress
rate-limit input access-group 121 15000000 2812500 5625000
conform-action transmit exceed-action drop
!
access-list 121 permit udp any any eq domain
Can anyone suggest how we might tighten this up and either have a
seperate rate limit list or somehow exclude my small list of resolver
IP's from the above limiting?
Thank you.
Mike
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
