Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zerigo DNS services down for 6+ hours due to massive DDoS

zerigostatus.com

Post reply on HN
Print view View original

61–62 of 62 posts

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#61

Post by gabriel-samfia »

cbsmith wrote: post #32

I can totally buy DDoS flooding network capacity, but I'm befuddled these days by statements saying the servers are "under load", which typically means "out of CPU". It's kind of hard for me to imagine even an i5 not being able to saturate a gigE line with DNS lookups (yes, it is a lot of packets, but it can be done) unless DNSSec is going on. Even 10gigE, if you can amortize interrupts, seems like it'd not be hard t…

There are many types of DDoS. Some max out your CPU, some your network. Given that a DDoS (Distributed Denial of Service) involves potentially thousands of willing or unwilling systems, it's relatively easy to make a server unresponsive.

I have a 100 Mb/s internet connection. Scale that up to 10000, and you have saturated even the fastest of internet connections.

Mitigating a DDoS is not easy. Heck, its damn near impossible, considering the fact that DNS DDoS attacks are done via UDP, which allow you to spoof the source IP address. Even if you do block the IP address of al the attackers, your upstream provider is still impacted by the packets trying to come into your server. Most upstream ISPs will blackhole your server IP to diminish the impact on their network.

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#62

Post by gabriel-samfia »

metalruler wrote: post #53

I've been seeing a lot of reflector attacks in the past couple of weeks, where the attacker sends a relatively small query for a valid domain that will return a large reply. The trick is that they spoof the source IP, so the DNS reply goes to the victim. I ended up hacking something together to firewall any IPs which sent more than 1000 requests in a short period of time.

We've seen the same kind of attack. We ended up limiting our DNS resolvers only to our own prefixes. It's a simple ACL in bind that allows recursion (domains your DNS server is not authoritative for), only to our subnets.
Post reply on HN