On Thu, Jun 28, 2012 at 04:04:47AM +0000, Michael Hoskins (michoski) <[email protected]> wrote a message of 61 lines which said:
> or even firewall based rate limiting like iptables or dummynet. > > http://codingfreak.blogspot.com/2010/01/iptables-rate-limit-incoming.html Did you try this on a production DNS server? Because I see some dangers in these rules, which do not seem well adapted to the DNS: 1) They use connection-tracking, which, for the DNS, mean one entry per DNS request. This may exhaust the memory of the server. 2) They are per-IP-address which does not help if the attacker can use many IP addresses (the problem is mostly for IPv6). I suggest using the hashlimit Netfilter module instead. _______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
