On 3/27/2013 9:34 AM, William Herrin wrote:
On Wed, Mar 27, 2013 at 10:00 AM, Jack Bates <jba...@brightok.net> wrote:
Tracking the clients would be a huge dataset and be especially complicated
in clusters. They'd be better off at detecting actual attack vectors rather
than rate limiting.
I count this among the several reasons I intend to wait until a
solution has been accepted into the bind mainline.
You'll also find that it serves little purpose. The only 2 methods for
stopping DNS amplification to my knowledge are:
1) tcp
2) require all requests to pad out to maximum response
3) BCP38 (in spirit)
The first has latency, load, and connection limitations. It is just too
expensive.
The second would stop amplification, however, it will not stop botnets
using them in attempts to hide the bot nodes in a very effective manner.
It's also unlikely that we'd ever see it implemented.
The only effective fix is still BCP38 (in spirit).
Jack
