[DNSOP] drop udp to stop DDOS?
"A. Schulze" <sca@andreasschulze.de> Sat, 01 October 2016 15:36 UTC
Return-Path: <sca@andreasschulze.de>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0480A12B0D6 for <dnsop@ietfa.amsl.com>; Sat, 1 Oct 2016 08:36:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.102
X-Spam-Level:
X-Spam-Status: No, score=-0.102 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=andreasschulze.de
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Ut8D95zS0La for <dnsop@ietfa.amsl.com>; Sat, 1 Oct 2016 08:36:35 -0700 (PDT)
Received: from mail.somaf.de (mail.somaf.de [IPv6:2001:a60:f0b4:e503:2cdb:beff:feaa:880b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3741A12B0CC for <dnsop@ietf.org>; Sat, 1 Oct 2016 08:36:34 -0700 (PDT)
Received: from andreasschulze.de (andreasschulze.de [IPv6:2001:a60:f0b4:e503:d86e:8dce:a73e:2fec]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) (Authenticated sender: sca@andreasschulze.de) by mail.somaf.de (Postfix) with ESMTPSA id 3smXTp6rwTzDbs for <dnsop@ietf.org>; Sat, 1 Oct 2016 17:36:30 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=andreasschulze.de; s=ybz; t=1475336191; bh=It9eEAWeY7qrXOlVCIBPVB5EVKWubEU81pTDE1pDEBk=; h=Date:From:To:Subject; b=EAYRGR6K7bJEdR4Al8hiA3KxA+Aw4bX14g+LnXZ8LCei36adNcIVPY0axODhu1vFs 1vZI1eALUoCTY5IH36QQl/bJnsvpmEFtIQDoDLs/5KxCiwVGunlFKFCwQxiV0Ssrj1 mb6oSohRrnpWDvlvYQZQ8YpqY50asCT0P/7lDutq335UqsTZgj35bf5DyDGP5QSIj+ jzdpTnz8cDoFgNZYO9QhdB1A8473xnnAVVam7ZREVOZEpsPM99h3dmBZRe+Nop3Mnu 0XuN41rPDPxRauaenb8/guzCPt8N0CYPP5s7RWOJLfo9J9G09rICtYTb93TBgtSEww 8bjs0xsSP2hew==
Received: from idviapproxy05.datev.de (idviapproxy05.datev.de [2a00:e50:f155:b:123b:572b:a625:1fb1]) by andreasschulze.de (Horde Framework) with HTTPS; Sat, 01 Oct 2016 17:36:27 +0200
Date: Sat, 01 Oct 2016 17:36:27 +0200
Message-ID: <20161001173627.Horde.rpSak5IJzXjNsCel4mT3q4Q@andreasschulze.de>
From: "A. Schulze" <sca@andreasschulze.de>
To: dnsop@ietf.org
User-Agent: Horde Application Framework 5
Content-Type: text/plain; charset="utf-8"; format="flowed"; DelSp="Yes"
MIME-Version: 1.0
Content-Disposition: inline
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/zXeTE3ubtzvAqXrapxQmPr0bDH8>
Subject: [DNSOP] drop udp to stop DDOS?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 01 Oct 2016 15:36:37 -0000
Hello, a nsd user posted an interesting question: https://open.nlnetlabs.nl/pipermail/nsd-users/2016-September/002364.html > Could we eliminate the DDoS threat by just turning off UDP? > > Recursive servers I understand probably have to keep accepting them, > but authoritative servers are only intended for recursive servers to > query, so would it be safe to just drop port 53 UDP requests? are there any experiences/opinions on that? Andreas
- [DNSOP] drop udp to stop DDOS? A. Schulze
- Re: [DNSOP] drop udp to stop DDOS? Jim Reid
- Re: [DNSOP] drop udp to stop DDOS? joel jaeggli