[45182] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: DNS DOS increasing?

daemon@ATHENA.MIT.EDU (Miquel van Smoorenburg)
Mon Jan 21 12:58:25 2002

To: nanog@merit.edu
From: Miquel van Smoorenburg <miquels@cistron.nl>
Date: Mon, 21 Jan 2002 17:58:03 +0000 (UTC)
Message-ID: <a2hkrb$9sh$1@ncc1701.cistron.net>
X-Complaints-To: abuse@cistron.nl
Errors-To: owner-nanog-outgoing@merit.edu


In article <cistron.171DAAD54475984F8F41345A0945DF9C39ED49@hqexchange.presidio.com>,
James Smith  <jsmith@PRESIDIO.com> wrote:
>  Get ready for more DOS-like behavior as systems get deployed that have 10
>second TTLs in the DNS. These systems are used to provide multi-isp
>redundancy by pinging each upstreams router, and when a ping fails, start
>giving out a dns response using the other ISP IP range. Same FQDN, new IP.

So what we need is a tunable on the caching DNS server that says

min_allowed_ttl = 300;

if (ttl < min_allowed_ttl) ttl = min_allowed_ttl;

If the above becomes a problem, this will happen.

Mike.

home help back first fref pref prev next nref lref last post