[Unbound-users] a mitigation against random subdomain attack
maciej at soltysiak.com
Tue Mar 24 10:57:54 UTC 2015
On Sun, Mar 22, 2015 at 1:31 PM, Daisuke HIGASHI <daisuke.higashi at gmail.com>
> I have implemented mitigation against random subdomain DoS attack (or
> sometime referred as water torture attack) for Unbound utilizing
> It learns qnames which resulted in noerror using bloomfilter in peace
> time. When a domain is set to be bloomfiltered (manually or
> automatically) it accepts only qnames to be noerror for the domain.
> This effectively refuse only bad random queries that result would be
> nxdomain while keeping the domain resolvable.
This is interesting; can you help me understand where does the 9.6 bits
Also, what would a false positive here be?
A random query that was allowed or a legitimate query that was refused?
> Daisuke HIGASHI
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Unbound-users