North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: large organization nameservers sending icmp packets to dns servers.
On Thu, 9 Aug 2007, Stephane Bortzmeyer wrote: > > On Wed, Aug 08, 2007 at 03:20:56PM -0700, > william(at)elan.net <[email protected]> wrote > a message of 23 lines which said: > > > How is that an "anti DoS" technique when you actually need to return > > an answer via UDP in order to force next request via TCP? > > Because there is no amplification: the UDP response packet can be very > small. actually because it forces authentication of the source (authentication being that the source is a real-live host asking for dns services). Beyond that trick, the deviecs I've seen/used also catalog the rates of queries from individual hosts and force a cached answer to be generated locally if the loads get too high (per source).. Sorry this is a bit late to the punch :)
|