Earlier quoted context omitted.
.....Why would it be?
to protect a visitor's privacy
Or to ensure that the content is not tampered.
Attack on DNS root servers
41–50 of 97 posts
Re: Attack on DNS root servers
#42What made this unique now? Was it simply a high load?
The root servers get large traffic spikes quite routinely, this event was simply an order of magnitude or more larger than any previous events (AFAIK). Also, it actually managed to DoS a few instances, by way of saturating their throughput--though as the notice mentions, the overall DNS wasn't significantly affected aside from a few queries having to be retried.
Re: Attack on DNS root servers
#43Earlier quoted context omitted.
Well I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4
It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
It's a 12 byte header + the query section, which is 4 bytes + the qname, a sequence of labels. Each label is a length octet + the ascii encoded characters of the label. A query for "us" would be 12 + 4 (02 75 73 00) + 4 = 20 bytes, plus the IP header (20 bytes) + the UDP header (8 bytes), so 48 bytes.
https://www.ietf.org/rfc/rfc768.txt
Re: Attack on DNS root servers
#44Re: Attack on DNS root servers
#45I bet the observed "random" source addresses are open recursive DNS servers. For this kind of attack they provide essentially free traffic-washing for whatever actual traffic-generation mechanism the attackers have.
Re: Attack on DNS root servers
#46I bet the observed "random" source addresses are open recursive DNS servers. For this kind of attack they provide essentially free traffic-washing for whatever actual traffic-generation mechanism the attackers have.
Nope.
The open recursive DNS servers, are real DNS servers, with caching and backoff logic. If, say, there are 94k [1] open DNS resolvers in the wild, each will ask you one DNS question for example.com, cache the answer and that's it.
The big volume for the "fixed domain" queries indicates proper BCP-38 spoofing.
Re: Attack on DNS root servers
#47related ?
Day 2: UK research network Janet still being slapped by DDoS attack DNS services appear to be targeted, switching may work
http://www.theregister.co.uk/2015/12/08/uk_research_network_...
Re: Attack on DNS root servers
#48Earlier quoted context omitted.
It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).
Yes, it is (especially UDP). Many networks still don't filter properly.
"The solution to this problem, described in RFC2827, which was written some 13 years ago by Paul Ferguson and Daniel Senie, is to block IP packets entering the internet which have source IP addresses which are forged..."
Re: Attack on DNS root servers
#49Earlier quoted context omitted.
It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
It's a 12 byte header + the query section, which is 4 bytes + the qname, a sequence of labels. Each label is a length octet + the ascii encoded characters of the label. A query for "us" would be 12 + 4 (02 75 73 00) + 4 = 20 bytes, plus the IP header (20 bytes) + the UDP header (8 bytes), so 48 bytes. https://www.ietf.org/rfc/rfc768.txt https://www.ietf.org/rfc/rfc791.txt https://www.ietf.org/rfc/rfc1035.txt
Thanks :). So ~20 Gbit/s.
(Also: I want your username.)
Re: Attack on DNS root servers
#50I bet the observed "random" source addresses are open recursive DNS servers. For this kind of attack they provide essentially free traffic-washing for whatever actual traffic-generation mechanism the attackers have.
Nope. The open recursive DNS servers, are real DNS servers, with caching and backoff logic. If, say, there are 94k [1] open DNS resolvers in the wild, each will ask you one DNS question for example.com, cache the answer and that's it. The big volume for the "fixed domain" queries indicates proper BCP-38 spoofing. [1] http://public-dns.tk/
Unless the attacker controlled the domain TTL, maybe? But good point -- I was thinking of a similar attack using random domains.