Subject: Re: DNS Server DoS Attacks

From: "Alec H. Peterson" <[email-masked]>
Date: Fri, 22 Nov 2002 19:55:11 -0700

--On Saturday, November 23, 2002 2:33 AM +0000 Paul Vixie <[email-masked]> 
wrote:

>
> well, like i said, we could secure the edge.

While we're at it why don't we deploy IPv6.

Alec

--
Alec H. Peterson -- [email-masked]
Chief Technology Officer
Catbird Networks, http://www.catbird.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Rob Thomas <[email-masked]>
Date: Sat, 23 Nov 2002 00:49:55 -0600 (CST)

] well, like i said, we could secure the edge.

Agreed.  In one study I conducted of an oft' attacked web site, 66.85%
of all naughty packets received were obvious bogons.  Not just spoofed
legitimate addresses, but outright bogons.  Honestly if I never receive
another packet from 127.1.2.3 I'll be a happy man.  :)  Think of the
amount of garbage we could avoid with some reasonably simple filtering.

The results of the study (along with a few others) can be seen in a
presentation I gave to Surfnet entitled "60 Days of Basic Naughtiness."
You will find a zip'd copy, in Powerpoint format, here:

http://www.cymru.com/Presentations/60Days.zip

The analyzed attacks are tame in comparison to what is seen today.  The
simple things work, often to a great degree.  Raising the bar won't
solve the world's problems, but it will make things a little better.

-- 
Rob Thomas
http://www.cymru.com
ASSERT(coffee != empty);