[161484] in North American Network Operators' Group
Re: [c-nsp] DNS amplification
daemon@ATHENA.MIT.EDU (Arturo Servin)
Sun Mar 17 11:33:21 2013
Date: Sun, 17 Mar 2013 12:33:01 -0300
From: Arturo Servin <arturo.servin@gmail.com>
To: Jon Lewis <jlewis@lewis.org>
In-Reply-To: <Pine.LNX.4.61.1303161745130.26706@soloth.lewis.org>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Yes, BCP38 is the solution.
Now, how widely is deployed?
Someone said in the IEPG session during the IETF86 that 80% of the
service providers had done it?
This raises two questions for me. One, is it really 80%, how to measure it?
Second, if it were 80%, how come the 20% makes so much trouble and how
to encourage it to deploy BCP38?
(well, actually 4 questions :)
Regards,
as
On 3/16/13 7:24 PM, Jon Lewis wrote:
> On Sat, 16 Mar 2013, Robert Joosten wrote:
>
>> Hi,
>>
>>>> Can anyone provide insight into how to defeat DNS amplification
>>>> attacks?
>>> Restrict resolvers to your customer networks.
>>
>> And deploy RPF
>
> uRPF / BCP38 is really the only solution. Even if we did close all the
> open recursion DNS servers (which is a good idea), the attackers would
> just shift to another protocol/service that provides amplification of
> traffic and can be aimed via spoofed source address packets. Going
> after DNS is playing whack-a-mole. DNS is the hip one right now. It's
> not the only one available.
