On 6/28/2012 8:47 PM, Stephane Bortzmeyer wrote: > On Thu, Jun 28, 2012 at 04:04:47AM +0000, > Michael Hoskins (michoski) <[email protected]> wrote > a message of 61 lines which said: > >> or even firewall based rate limiting like iptables or dummynet. >> >> http://codingfreak.blogspot.com/2010/01/iptables-rate-limit-incoming.html > ... > > I suggest using the hashlimit Netfilter module instead.
there is not enough information available upstream of the dns server, at query receive time, to know whether or not to drop the query. you have to know what the prospective response is, and drop that. paul _______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
