Hi, On Tue, Dec 31, 2013 at 09:34:17PM +0000, Dobbins, Roland wrote: > Also, if you're on the designated-target leg of a DNS > reflection/amplification attack, in most (not all; directly-spoofed ANY > attacks and the like, which don't involve open recursors, are the exception) > cases, you're receiving traffic from open recursors, not authoritative > severs, and the sources you end up blocking are open recursors, not > authoritative servers.
Attackers have long started to use authoritatives as well. Which is why
Paul Vixie's RRL or Lutz Donnerhacke's dampening patches for BIND exist.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpGzTDH_caH9.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
