Re: [DNSOP] New Version Notification for draft-jabley-dnsop-refuse-any-00.txt

[Paul Vixie <[e-mail]>]

Shane Kerr wrote:
>
>
> In the case where people just want to reduce the damage of ANY queries
> in reflection attacks, I quite like the PowerDNS option of forcing ANY
> queries to TCP via truncation. I'm not sure if this has been documented
> in any RFC, but if not then perhaps it bears mentioning too?

note that in a normal reflective ddos where a lot of ANY queries are
being received, the above proposal results in a full TCP session table,
thus denying TCP service to any non-attacker.

this is not a serious problem since virtually anyone can launch a denial
of service against TCP/53, without a distributed attack force. so, that
problem already exists.

if it's going to become a documented operational practice, then this
risk should be documented also.

-- 
Paul Vixie