Re: Open Resolver Dataset Update

2013-04-10 Thread Jared Mauch
I sent you a private reply, but also posting publicly… On Apr 9, 2013, at 4:55 PM, "A. Pishdadi" wrote: > In the last 2 weeks we have seen double the amount of ddos attacks, and way > bigger then normal. All of them being amplification attacks. I think the > media whoring done during the spam

Re: Open Resolver Dataset Update

2013-04-09 Thread A. Pishdadi
In the last 2 weeks we have seen double the amount of ddos attacks, and way bigger then normal. All of them being amplification attacks. I think the media whoring done during the spamhaus debacle motivated more people to invest time building up there openresolver list, since really no one has discl

Re: Open Resolver Dataset Update

2013-04-09 Thread Jared Mauch
Tom, The main criteria is the RCODE=0 vs RCODE=5 refused. I exposed the Recursion Available bit this last week to cover more of the use cases, but many servers provide a very large referral to root. You are correct in that your system doesn't provide that so should be less "visible" as a resul

Re: Open Resolver Dataset Update

2013-04-09 Thread Tom Laermans
Jared, If you mean there can be a referral with RCODE=0 and Recursion Available = 0, you'll need a third column actually documenting if there is a referral. This server is listed in ORP: $ dig www.google.be @195.160.166.139 ; <<>> DiG 9.7.3 <<>> www.google.be @195.160.166.139 ;; global options:

Re: Open Resolver Dataset Update

2013-04-08 Thread Jared Mauch
The referral, including a referral to root can be quite large. Even larger than answering a normal query. I have broken the data out for the purpose of letting people identify the IPs that provide that. Jared Mauch On Apr 8, 2013, at 3:08 AM, Tom Laermans wrote: > As far as I know, respondin

Re: Open Resolver Dataset Update

2013-04-08 Thread Mark Andrews
In message <51626cf9.1040...@phyxia.net>, Tom Laermans writes: > On 7/04/2013 19:46, Jared Mauch wrote: > > I've continued to update my dataset originally posted about two weeks ago. > > Please take a moment > and review your CIDRs which may be running an open resolver. > > > > I've exposed one

Re: Open Resolver Dataset Update

2013-04-08 Thread Tom Laermans
On 7/04/2013 19:46, Jared Mauch wrote: I've continued to update my dataset originally posted about two weeks ago. Please take a moment and review your CIDRs which may be running an open resolver. I've exposed one additional bit in the user-interface that may be helpful. Some DNS servers wil

Open Resolver Dataset Update

2013-04-07 Thread Jared Mauch
I've continued to update my dataset originally posted about two weeks ago. Please take a moment and review your CIDRs which may be running an open resolver. I've exposed one additional bit in the user-interface that may be helpful. Some DNS servers will respond with RCODE=0 (OK) but not provi