Subject: EDNS0 traffic amplification attacks in the wild

From: Florian Weimer <[email-masked]>
Date: Wed, 30 Nov 2005 10:35:35 +0100

There are some reorts on BUGTRAQ which indicate that open resolvers
with EDNS0 support are now abused for traffic amplification purposes:

  <http://marc.theaimsgroup.com/?t=113320946500009&r=1&w=2>

(The posted packet capture contains an OPT RR with a buffer size of
10000.)

I know that people generally think this is a non-issue because you
should offer resolver service to the Internet at large anyway, but I'm
reporting this here in case anyone is working on RFC 2671bis and wants
to include an updated Security Considerations section.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 30 Nov 2005 21:43:51 +1100

> to include an updated Security Considerations section.

	Just another reason to deploy BCP38 everywhere.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Edward Lewis <[email-masked]>
Date: Wed, 30 Nov 2005 08:53:37 -0500

>	Just another reason to deploy BCP38 everywhere.

I've already tried to ask the RFC editor to make it easier to find 
the BCPs (e.g., putting a link on their home page to a list of them). 
One answer I was given was "if you know the RFC number, just look 
that up."  So, in that spirit, what is the RFC number of BCP38?
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

3 months to the next trip.  I guess it's finally time to settle down and
find a grocery store.

---

From: Florian Weimer <[email-masked]>
Date: Wed, 30 Nov 2005 15:48:26 +0100

> the BCPs (e.g., putting a link on their home page to a list of them). 

<http://www.rfc-editor.org/cgi-bin/rfcsearch.pl> works quite well.
Just enter "BCP38" in the search field.

> that up."  So, in that spirit, what is the RFC number of BCP38?

From the context, it's likely that Mark means the RFC on ingress
filtering. 8-P

---

From: Mark Andrews <[email-masked]>
Date: Thu, 01 Dec 2005 07:23:51 +1100

> that up."  So, in that spirit, what is the RFC number of BCP38?

	The RFC editor should have known better.

	Google for it :-)

Network Working Group                                        P. Ferguson
Request for Comments: 2827                           Cisco Systems, Inc.
Obsoletes: 2267                                                 D. Senie
BCP: 38                                           Amaranth Networks Inc.
Category: Best Current Practice                                 May 2000

                       Network Ingress Filtering:
            Defeating Denial of Service Attacks which employ
                       IP Source Address Spoofing
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]