Re: limit UDP connection rate with PF pass rule

2020-11-21 Thread Stuart Henderson
On 2020-11-18, mabi wrote: >> The DNS RRL techniques typically still reply to a proportion of queries >> (either directly with the answer, or with a "retry over TCP" response >> code) reducing impact if the source IP is also used by real queries as >> well as the attack traffic. > > I've been look

Re: limit UDP connection rate with PF pass rule

2020-11-18 Thread mabi
‐‐‐ Original Message ‐‐‐ On Tuesday, November 17, 2020 11:50 PM, Stuart Henderson wrote: > These packets are most likely sent from spoofed source addresses. > > Assuming this is the case, the address you are seeing on the packets > would not be the attacker but the victim. That totally

Re: limit UDP connection rate with PF pass rule

2020-11-17 Thread Stuart Henderson
On 2020-11-17, mabi wrote: > Hello, > > On my DNS authoritative servers which are behind an OpenBSD 6.6 firewall I > just saw some weird UDP high volume traffic on port 53 my these DNS servers > coming from Google (e.g. 74.125.18.1 or 172.253.214.111). > > These few IPs generated around 5200 req

limit UDP connection rate with PF pass rule

2020-11-17 Thread mabi
Hello, On my DNS authoritative servers which are behind an OpenBSD 6.6 firewall I just saw some weird UDP high volume traffic on port 53 my these DNS servers coming from Google (e.g. 74.125.18.1 or 172.253.214.111). These few IPs generated around 5200 requests/second on my DNS servers so I was

Re: limit UDP connection rate with PF pass rule

2020-11-17 Thread Ben Jahmine
> On my DNS authoritative servers which are behind an OpenBSD 6.6 firewall I > just saw some weird UDP high volume traffic on port 53 my these DNS servers > coming from Google (e.g. 74.125.18.1 or 172.253.214.111). > > These few IPs generated around 5200 requests/second on my DNS servers so I >