Curious, how does uRPF help under this scenario? Although the source address is spoofed, the target is stil valid destination address. — Laurent
On Sat, Mar 16, 2013 at 6:38 PM, David Rothera <[email protected]> wrote: > Depends on whether you want to defeat being the person being attacked or > the person being "tricked" into being the person doing the amplification > attack. > For stopping being attacked without taking services from your upstream > provider the only thing you can do really is police DNS traffic as uRPF > isn't going to be of much help as it will generally be coming from the > correct ingress interface. > As far as stopping being the attacker as others have said use uRPF and > limit your resolvers to only allow access from hosts within your own AS. > David > On Saturday, March 16, 2013, harbor235 wrote: >> Can anyone provide insight into how to defeat DNS amplification attacks? >> >> >> thanks, >> >> Mike >> _______________________________________________ >> cisco-nsp mailing list [email protected] <javascript:;> >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> > -- > David Rothera > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
