On 2012-06-28 3:57 AM, pangj wrote: > >> at<http://www.redbarn.org/dns/ratelimits> you will find one >> experimental approach to doing this, if your name server is BIND9. note >> that this feature is not supported by ISC at this time, but that the >> authors of the experimental technology would welcome any comments, bug >> reports, questions, or feedback on the topic. > > > Thank you, yes I am running with BIND 9.7.
you would need to upgrade to BIND 9.8 or 9.9 to be able to use the DNS RRL patches. > Is the RRL based on the incoming source IP? yes. > since the source IPs are most probably spoofed, how will the patch > make effect? DNS RRL looks for unnatural similarities in a <ip-src, dns-response> flow, and limits the rate accordingly. it will not stop a random-sourced attack nor a widely-reflected attack, but it has been shown to stop targetted attacks using a small number of reflectors. there is a technical note at <http://www.redbarn.org/dns/ratelimits> which describes the approach in detail. paul _______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
