26 Nov
2003
26 Nov
'03
2:52 p.m.
On Wed, 26 Nov 2003, Arjan Hulsebos wrote:
The Netherlands were hit as well. We saw a massive flood of queries for lockup.zonelabs.com, too. It performed a nice DoS on our client name servers.... :-(
You'd think that an unresponsive nameserver would be flagged dead, and such information be cached. Does anyone know whether that's actually done in Bind 8.3.4? Or perhaps not by default?
BIND9 does this, but it won't prevent clients from still asking the question over and over again. So an ISP with lots of downstream dumb clients (i.e. Windows) will still experience the DOS unless they have sufficient capacity in their DNS servers or rate-limit tcp/udp 53 at their network edge. client -> caching name server -> authoritative name server