[swinog] IRC Network / Swinog / Link down

Hi there There's an issue around that the IRC Channel #swinog is in a splitted state (Link between irc.humppa.ch and irc.swissix.ch). The reason: It seems that irc.swissix.ch NTP/date is out of sync. As soon as some1 there has fixed the Issue, the #swinog Channel will have both part of the

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Look here: http://dns.comcast.net/ Same two device types I have found. Mit freundlichen Grüssen Benoit Panizzon -- I m p r o W a r e A G- __ Zurlindenstrasse 29 Tel +41 61 826 93 07 CH-4133 PrattelnFax

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

> netgear tech support has confirmed there is a problem in one of the models and released a fixed firmware. Great! How do I tell the customers? Mit redirect the http traffic for those customer to an webpage which explain and offer a download link on that page maybe combine with a dns ratelimit

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

On 2013-05-24 14:33 , Roman Hochuli wrote: > Hey All > > If it is really hurting you big time you may choose to run a very mean > hack: temporarily setup a netgear.com-Zone on your dns-servers and point > these records to a useful NTP server. Adding an A-record for their > website would probably a

Re: [swinog] WG: DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

On 2013-05-24 14:04 , Michael Richter wrote: > Hmm I thought it is better you'll do the rate limiting on a lower > layer. > It's the same fix. you give the customer x queries in y time. It is FAR from the "same fix". RRL has knowledge of the query and the answer it would give. Amongst others RRL

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

> If it is really hurting you big time you may choose to run a very mean > hack: temporarily setup a netgear.com-Zone on your dns-servers and point > these records to a useful NTP server. Adding an A-record for their > website would probably a good idea as well. ;) > > Yes, it is an EXTREMELY UGLY

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Hi folks We have experienced this issue a lot with the WNDR4500 model in the last months. This is definitely a bug, which can be fixed with a newer FW release. Whenever we see constant traffic of approx. 10 Mbps and high CPU on our name servers, it's a WNDR4500. I'm not completely sure, but it

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Thanks Gregor!! that was exactly what I was looking for. have a nice weekend --- >You want to deploy RRL. > >iptables is not the right location for doing this kind of stuff as you will >have false positives. > >Please see http://www.redbarn.org/dns/ratelimits I agree

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Hi Jeroen > You want to deploy RRL. > > Please see http://www.redbarn.org/dns/ratelimits Excellent, thank you. Didn't know that bind feature. Mit freundlichen Grüssen Benoit Panizzon -- I m p r o W a r e A G- __ Zurlindenstrasse 2

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Hey all We had the same problem, at last a few weeks ago. We reported it to Netgear in Dec 12 for the first Time -> no result We tried to overwrite these records with another -> just for testing. The routers were still asking k-times a second. I think it's not a DNS-problem, cause it doesn't m

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

>You want to deploy RRL. > >iptables is not the right location for doing this kind of stuff as you will >have false positives. > >Please see http://www.redbarn.org/dns/ratelimits I agree that iptables might not be the perfect solution for that, however, as we have also been confronted with that

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Hey All If it is really hurting you big time you may choose to run a very mean hack: temporarily setup a netgear.com-Zone on your dns-servers and point these records to a useful NTP server. Adding an A-record for their website would probably a good idea as well. ;) Yes, it is an EXTREMELY UGLY HA

[swinog] WG: DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Hmm I thought it is better you'll do the rate limiting on a lower layer. It's the same fix. you give the customer x queries in y time. But with RRL I think every query is counted. With iptables you can say, just count the ANY queries. So it's more specific Freundliche Grüsse sasag Kabelkommun

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

On 2013-05-24 12:52 , Michael Richter wrote: [..] > What can you do to limit this stupid traffic: - rate limit the > queries per customer (not really a good idea) - rate limit this > special kind of queries. (that's the best way at the moment) > > I haven't had the time to look into the packets to

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Hello Benoit On 24.05.2013 12:03, Benoit Panizzon wrote: It looks like our customers Netgear routers (known ones: WNR3500Lv2, WNDR4500) are asking our DNS Server for the A record of: time-g.netgear.com or time- a.netgear.com For me this looks like entries for timeservers (NTP). This two desti

Re: [swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

I have the same issue since some weeks. The problem is that the customer does not understand the problem. So if Netgear has solved the problem in a new firmware the customer should update it, but does he knows how to do this??? What can you do to limit this stupid traffic: - rate limit the quer

[swinog] DDOS DNS Attack by Netgear Products caused by CNAME instead of A record?

Heyo! Any others who are being affected? It looks like our customers Netgear routers (known ones: WNR3500Lv2, WNDR4500) are asking our DNS Server for the A record of: time-g.netgear.com or time- a.netgear.com Instead of an A record reply, they get a CNAME as answer with additional information

[swinog] Unix-/Linux Spezialist sucht neue Arbeits Herausforderung

Hallo Ein sehr guter Freund und sozial engagierter Unix-/Linux Engineer Spezialist mit gutem Fachwissen in Apache Server, Security und Netzwerk Bereich such derzeit eine neue Arbeits Herausforderung. Bis vor kurzem war er für die Post/Postfinance tätig wo er unter anderem den Angriff von Anon au