Subject: [DNSOP] drop udp to stop DDOS?

From: "A. Schulze" <[email-masked]>
Date: Sat, 01 Oct 2016 17:36:27 +0200

Hello,

a nsd user posted an interesting question:
https://open.nlnetlabs.nl/pipermail/nsd-users/2016-September/002364.html

> Could we eliminate the DDoS threat by just turning off UDP?
>
> Recursive servers I understand probably have to keep accepting them,  
> but authoritative servers are only intended for recursive servers to  
> query, so would it be safe to just drop port 53 UDP requests?

are there any experiences/opinions on that?
Andreas

---

From: Jim Reid <[email-masked]>
Date: Sat, 1 Oct 2016 16:50:37 +0100

> On 1 Oct 2016, at 16:36, A. Schulze <[email-masked]> wrote:
> 
>> Recursive servers I understand probably have to keep accepting them, but authoritative servers are only intended for recursive servers to query, so would it be safe to just drop port 53 UDP requests?
> 

Quite probably. They will be very unhappy ones.

The OP hasn’t yet figured out which port number and transport resolving servers use when they query authoritative servers.

---

From: joel jaeggli <[email-masked]>
Date: Sat, 1 Oct 2016 22:25:54 -0700

> are there any experiences/opinions on that?
Recursing resolvers expect to be able to contact an authoritative
nameserver on udp 53, so if you just drop that in a hole that is going
to be kinda of a problem because they're going to time out.

There is a bit of an art to protecting servers from packets that they
shouldn't be recieving. just because it has to listen on udp 53 does no
mean it has to be able to recieve udp traffic for all other dports.it's
own queries for example could be done with a different source ip.

Once you get beyond (dns / ntp) reflection though theres no particular
reasion why a volumetric dos attack needs to use the UDP header. For
that matter the traffic doesn't even need to splash on the target host
to be effective if the goal is bandwidth consumption.

>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>