Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: DNS-based DDoS - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
DNS-based DDoS

ISC reader Zach reports that his company currently sees about 4Gbps of DNS requests beyond what is "normal", and all seem to originate from Yup, someone on that IP range in Poland is likely having a "slow network day".

To make it less likely that your DNS servers unwittingly participate in a denial of service attack against someone else, consider using rate-limiting. If you are not running a massively popular eCommerce site, odds are your bandwidth and the load limit of your DNS server are way way beyond what you actually need.

The easiest way to rate-limit (if you use Linux) is to put an iptables rule on port 53 that controls how many packets per source IP address will be accepted per minute. BIND, one of the most popular DNS servers, introduced a response rate-limiting option in version 9.10 that allows to define how many responses per second the server will provide before it punts. Both are good ideas if you run an authoritative DNS server that has way more bandwidth and muscle than your actual usage requires.



385 Posts
ISC Handler
Feb 19th 2015
Thanks for the tip about rate-limit. Will explore.

Another option is to use 3rd party DNS services such as Amazon Route 53 or Google Cloud DNS.
Or uses CloudFlare free account to manage DNS hosting.

Sign Up for Free or Log In to start participating in the conversation!