dns-operations AT lists.opennicproject.org

Subject: Dns-operations mailing list

List archive

Re: [opennic-dns-operations] lot of traffic to isc.org

From: Jeff Taylor <shdwdrgn AT sourpuss.net>
To: dns-operations AT lists.opennicproject.org
Subject: Re: [opennic-dns-operations] lot of traffic to isc.org
Date: Thu, 22 Nov 2012 16:46:43 -0700

Based on some logs sent to me, the following rule appears to work for
ripe.net attacks...

iptables -I INPUT -p udp -m string --hex-string
"|0000000000010472697065036e6574|" --algo bm --to 65535 --dport 53 -j DROP

[opennic-dns-operations] lot of traffic to isc.org, Stefan Sabolowitsch, 11/22/2012
- Re: [opennic-dns-operations] lot of traffic to isc.org, Alex Hanselka, 11/22/2012
  - Re: [opennic-dns-operations] lot of traffic to isc.org, Steven Coutts, 11/22/2012
    - Re: [opennic-dns-operations] lot of traffic to isc.org, Jeff Taylor, 11/22/2012
      - Re: [opennic-dns-operations] lot of traffic to isc.org, Brian Koontz, 11/22/2012
      - Re: [opennic-dns-operations] lot of traffic to isc.org, Psilo, 11/22/2012
        
        Re: [opennic-dns-operations] lot of traffic to isc.org, Jeff Taylor, 11/22/2012
- Re: [opennic-dns-operations] lot of traffic to isc.org, Jeff Taylor, 11/22/2012
- <Possible follow-up(s)>
- Re: [opennic-dns-operations] lot of traffic to isc.org, Steven Coutts, 11/22/2012