[89450] in North American Network Operators' Group
Re: DNS Amplification Attacks
daemon@ATHENA.MIT.EDU (ennova2005-nanog@yahoo.com)
Fri Mar 17 18:28:40 2006
Date: Fri, 17 Mar 2006 15:27:03 -0800 (PST)
From: <ennova2005-nanog@yahoo.com>
Reply-To: ennova2005-nanog@yahoo.com
To: Gadi Evron <ge@linuxbox.org>, nanog@merit.edu
In-Reply-To: <441B30FE.3010704@linuxbox.org>
Errors-To: owner-nanog@merit.edu
--0-143569201-1142638023=:71204
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
That ISPs still do not filter inbound traffic from their customers to prevent source spoofing is amazing.
Done closer to the ingress edge this filtering shouldnt be that expensive. Not everyone will do it, but atleast it will limit the places from where source address spoofing attacks originate.
The administrative burden arguments dont fly - a list of routes and IP address assignments per customer is already maintained both by ISPs and the customers -and route filters access lists are routinely automated.
So beyond laziness - are there any technical reasons why this causes problems for anyone ?
Gadi Evron <ge@linuxbox.org> wrote:
In this paper we address in detail how the recent DNS DDoS attacks work.
How they abuse name servers, EDNS, the recursive feature and UDP packet
spoofing, as well as how the amplification effect works.
Our study is based on packet captures (we provide with samples) and logs
from attacks on different networks reported to have a volume of 2.8Gbps.
One of these networks indicated some attacks have reached as high as
10Gbps and used as many as 140,000 exploited name servers.
In the conclusions we also discuss some remediation suggestions.
Given recent events, we have been encouraged to make this text available
at this time.
URL: http://www.isotf.org/news/DNS-Amplification-Attacks.pdf
Please note that this version of this paper is prior to submission for
publication and that the final version may see significant revisions.
Thanks,
Randy Vaughn and Gadi Evron.
--0-143569201-1142638023=:71204
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
That ISPs still do not filter inbound traffic from their customers to prevent source spoofing is amazing. <br><br>Done closer to the ingress edge this filtering shouldnt be that expensive. Not everyone will do it, but atleast it will limit the places from where source address spoofing attacks originate.<br><br>The administrative burden arguments dont fly - a list of routes and IP address assignments per customer is already maintained both by ISPs and the customers -and route filters access lists are routinely automated. <br><br>So beyond laziness - are there any technical reasons why this causes problems for anyone ?<br><br><br><b><i>Gadi Evron <ge@linuxbox.org></i></b> wrote:<blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> <br>In this paper we address in detail how the recent DNS DDoS attacks work.<br>How they abuse name servers, EDNS, the recursive feature and UDP packet <br>spoofing, a
s well
as how the amplification effect works.<br><br>Our study is based on packet captures (we provide with samples) and logs <br>from attacks on different networks reported to have a volume of 2.8Gbps. <br>One of these networks indicated some attacks have reached as high as <br>10Gbps and used as many as 140,000 exploited name servers.<br><br>In the conclusions we also discuss some remediation suggestions.<br><br>Given recent events, we have been encouraged to make this text available <br>at this time.<br><br>URL: http://www.isotf.org/news/DNS-Amplification-Attacks.pdf<br><br>Please note that this version of this paper is prior to submission for <br>publication and that the final version may see significant revisions.<br><br>Thanks,<br><br>Randy Vaughn and Gadi Evron.<br></blockquote><br>
--0-143569201-1142638023=:71204--
