Subject: RE: stopping amplification

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 28 Mar 2006 13:12:19 -0800

> On Tue, 28 Mar 2006 11:40:54 -0800 Phillip wrote:
> HBP> I have been trying to work out what the real problem here is. In 
> HBP> particular why is the reflected attack worse than the 
> direct attack?
> 
> Reflection helps hide the source of the attack.

But they are using spoofed source addresses?

> HBP> The only difference I can see between direct and 
> reflected is that 
> HBP> the open resolver used in the reflected attack is going 
> to do retries.
> 
> You are looking at the wrong end of the resolver. The attack 
> is the response from the open resolver, not the queries the 
> resolver makes to respond to the (spoofed) packet. The 
> resolver will not retry sending response packets.

In which case won't the same problem affect every DNS server?

> HBP> I have a very hard time seeing how extending the packet 
> size from 
> HBP> about 50 bytes plus header to 500 bytes plus header turns the 
> HBP> attack into a devestating one,
> 
> When you multiply that by the number of open recursive servers
> (unknowingly) participating in the attack, bandwidth very 
> much becomes a factor. Haven't you seen the bandwidth numbers 
> people were reporting for these attacks? Gigabits per second.

And what is the bandwidth these people are using to create the attack? A
botnet can generate gigabits per second too. If we were talking about jumbo
packets and there was an order of magnitude difference I could see
amplification as being the motivation. 

It is much easier to run a flood attack on the botnet host fast than to find
a DNS resolver that responds fast enough to make this an amplification
attack. The DNS resolver has to be on iron big enough to saturate its output
bandwidth for a start.

I understand the damage caused, like Paul I do not agree that amplification
is the primary motive for this behavior.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 29 Mar 2006 10:08:50 +1100

> But they are using spoofed source addresses?

	You have to get the ISP of the reflector to initiate the
	traffic backtrace rather than initiating the traffic traceback
	your self.  With the latter you might have agreements with your
	peers that they will do a traceback through their network if
	you request it.

	You are unlikely to have such a agreement with the reflectors
	ISP.

> In which case won't the same problem affect every DNS server?

	Yes.  Closing ORNs is just exercise to reduce the scale
	of the problem.
 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>