Discuss mailing list

[Kenny Taylor <kennytaylor AT runbox.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I got hit with upwards of 1,000/sec root ANY requests a couple weeks back.  
The responses were only 278 bytes, so it didn't consume much bw.  Late last 
week I saw a similar attack doing ANY queries against isc.org.

Haven't seen the huge Russian TXT records..  That sounds harsh.

Kenny


Guillaume Parent <gparent AT gparent.org> wrote:

>Hey guys,
>
>Got hit by my first semi significant DoS today, about 28 queries per
>second
>caused 4 Mbps outbound.
>
>CPU went from 4-6% to 20%. The whole thing went on for about 4-5 hours
>until I blacklisted the 3 IPs involved.
>
>They requested a massive TXT record that was on a russian server
>somewhere.
>
>Anyone see something similar?
>
>
>--------
>You are a member of the OpenNIC Discuss list.
>You may unsubscribe by emailing
>discuss-unsubscribe AT lists.opennicproject.org
-----BEGIN PGP SIGNATURE-----
Version: APG v1.0.8

iQJDBAEBCAAtBQJRbKr5JhxLZW5ueSBUYXlsb3IgPGtlbm55dGF5bG9yQHJ1bmJv
eC5jb20+AAoJELOordj4VKFQyNgQALCk4TCPnjOHCHE8+yp2dL+seILAb0MznB0X
RSDafpVHQ+APlwJ4Uf7xn+wOGnQujk76d4Yh5fPwJk4wn4PQoEX/a8MLrEoEQLdq
uSQlbkfzCCoziHXrvpObuKY0O9GDUB5uMFay5Gr5+wq/TbVblpwxcyv1RiKJZ9uX
zu4/B/SA0CWHURu6EgLlU28sHbpqlyQUd9DszEgvMavKK+cOCtv5j1wPaQNiWFQf
Bzg+bpHxn1GUdHVkxUvtZsw5s/DVIa11zh2dwfJWlEhKOmDTA8KwW/5SxD6AZc+J
ZvKxQFclgJmyteYdi6UXBVSAy2yWwBr3tu6qsCKtM7rsVC/ciqPsATsuOkPH2cwF
NfWtkxw5KztxJsUpwDcBNDXPHTDMe9ccFhyirDVYKeQrO4KIh7vcgmy+UpZfiXW4
pmyQpwqweVroFsl3yrDg5gz3YP+jdjD7DeM+3qNXnL64OtyNypGTMWoyO6YKI1zX
7RkUkeoMQBgV+HAobzdzMt19AKueBajauJ2ymX3gYzG9Cv6AzEXPO/HBwB36yf8N
tevuf2aoIeN3v6/PnIy9GefHVDeDIHKGDHJ4pDJIkqnzdpguiPFIGYpTq8SKvJaz
gXiqwxKHs7xBpJbaIO+U3qavmSKAVaaaJPsnR64iPkJaRWctwH0nLthcao8VeHG/
6tlG/KY0
=nMFp
-----END PGP SIGNATURE-----