[Unbound-users] Unbound DDoS / reflexion attack counter-measure?
ales at rygl.net
Sat May 31 07:13:33 CEST 2014
we have exactly have the same issue. Being ISP with thousands of
misconfigured clients with open resolvers in their DSL modems (which you even
can not fix because if buggy firmware) you can not simply cut them off. We
were using PowerDNS in the past and when these attack started we migrated
completely to Unbound.
Unbound is much more resistant to such attack nevertheless in order to get rid
of it we are doing following using a script:
- query Unbound for running queries every minute using unbound-control
- count queries for every 2nd or 3rd leveldomain
- if there is more queries than threshold for a domain we compare the domain
with alexa list http://www.alexa.com/topsites
- if there is a a match such entry is ignored
- if not such domain is under attack and we create local zone for sending
We do it every minute. It is not perfect but after about 4 moths we had just
about 2-3 false positives. We have 8 servers behind LVS and since then we have
no problems any more.
On Saturday 31 of May 2014 03:58:05 Daisuke HIGASHI wrote:
> And increasing these params would mitigate this kind of attacks:
> "Howto Optimise" document will help.
> Daisuke HIGASHI
> 2014-05-31 10:39 GMT+09:00 Daisuke HIGASHI <daisuke.higashi at gmail.com>:
> > Hi,
> > A countermeasure would be just blackholing "sidear.cn".
> > # queries for sidear.cn is just dropped and generates no answer.
> > local-zone: "sidear.cn" deny
> > - or -
> > # queries for sidear.cn returns REFUSED
> > local-zone: "sidear.cn" refuse
> > ------
> > Next (current) terget is yahoo.com ?
> > $ dig @a.dns.cn sidear.cn
> > ;; QUESTION SECTION:
> > ;sidear.cn. IN A
> > ;; AUTHORITY SECTION:
> > sidear.cn. 86400 IN NS ns2.yahoo.com.
> > sidear.cn. 86400 IN NS ns1.yahoo.com.
> > --
> > Daisuke HIGASHI
> Unbound-users mailing list
> Unbound-users at unbound.net
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Unbound-users