[72273] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Sipura VoIP phone adapters and DoS against name servers

daemon@ATHENA.MIT.EDU (sthaug@nethelp.no)
Mon Jul 5 12:57:45 2004

To: nanog@merit.edu
From: sthaug@nethelp.no
Date: Mon, 05 Jul 2004 18:57:03 +0200
Errors-To: owner-nanog-outgoing@merit.edu


Last night we configured our equipment to reject recursive DNS lookups
from non-customers. This morning, soon after normal office hours began,
we started receiving around 2500 DNS lookups per second more than normal
to our recursive name servers.

After analyzing the DNS lookups, we found that all of the extra traffic
was generated from customers of a local VoIP provider which uses Sipura
(SPA-2000) phone adapters. It seems that when these adapters don't
receive answers to their DNS queries, they will retransmit the query
once per second (until they receive an answer). Multiply by number of
adapters, and you have the recipe for a nice DoS.

Shades of Netgear NTP DoS (http://www.cs.wisc.edu/~plonka/netgear-sntp/)
- don't vendors ever learn?

Steinar Haug, Nethelp consulting, sthaug@nethelp.no

home help back first fref pref prev next nref lref last post