6 ms·

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give adverti

by robryk 11y ago

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).

comboy 11y ago
Well I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4
- deleted 11y ago
  [deleted]
- johansch 11y ago
  It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
  - comboy 11y ago
    Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).
    - __jal 11y ago
      If this was a botnot, any one ISP is only seeing a tiny fraction of the load. Even if it were from a single source, it also isn't that hard to find an ISP that doesn't care. (They cost slightly more, but if you're a bad actor, presumably it is worth it.) Edit: "I think pretty much any ISP wouldn't let such packets through" If you google "BCP38", you will find well over a decade of network operators discussing specifically this topic and the reasons why ISPs (and other networks) don't, not to mention all the fun the kvetching and meta-kvetching that accompanies any technical discussion that's lasted so long.
      - cft 11y ago
        After you have been a target of ~50 Gbps NTP reflection attacks that nearly destroyed our company, it's hard to be impartial in these discussions.
        cmdrfred 11y ago
        50gbps? Who did you piss off, damn.
    - r1ch 11y ago
      On residential ISPs it's generally not so easy, but I think pretty much every dedicated server provider I've used has allowed spoofed source IPs.
    - gcommer 11y ago
      It is, way too many ISPs still don't filter packets with obviously spoofed IP addresses. That said, even if the attackers in this event didn't spoof the IP address, they would almost certainly have still had a very wide distribution of addresses. > DNS root name servers that use IP anycast observed this traffic at a significant number of anycast sites. DNS root name servers are BGP anycasted: without knowing the maintenance routes, any packets you send will get routed to the topologically nearest instance. So, since the traffic source managed to hit multiple, geographically disperse anycast sites we can infer that they were able to generate traffic from worldwide traffic sources.
    - w8rbt 11y ago
      Yes, it is (especially UDP). Many networks still don't filter properly. "The solution to this problem, described in RFC2827, which was written some 13 years ago by Paul Ferguson and Daniel Senie, is to block IP packets entering the internet which have source IP addresses which are forged..." http://tools.ietf.org/html/rfc2827.html http://tools.ietf.org/html/rfc2827.html http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
    - kaeso 11y ago
      Reality check: ~30% of active AS worldwide don't drop spoofed packets originating from their networks. http://spoofer.cmand.org/summary.php http://spoofer.cmand.org/summary.php
      - tkinom 11y ago
        It is a bit like polluting the ocean by dumping wastes. It cost less for the polluters if they are not caught. For "typical AS router", is it easy or cheap to block spoofed packets? I wonder if that test software/website can/should "OUT / Shame" the AS routing subnets as "Major Internet Polluters" and publish a monthly reports to shame that 30% polluters.
    - dboreham 11y ago
      Certainly both our upstream providers allow through alien source address packets. This has caused me some head scratching on occasion, as in "how the #^$&#^ is this even working??". I suspect the reason is that it is non-trivial to collect and manage the list of kosher subnets once you exceed a certain size.
  - js2 11y ago
    It's a 12 byte header + the query section, which is 4 bytes + the qname, a sequence of labels. Each label is a length octet + the ascii encoded characters of the label. A query for "us" would be 12 + 4 (02 75 73 00) + 4 = 20 bytes, plus the IP header (20 bytes) + the UDP header (8 bytes), so 48 bytes. https://www.ietf.org/rfc/rfc768.txt https://www.ietf.org/rfc/rfc768.txt https://www.ietf.org/rfc/rfc791.txt https://www.ietf.org/rfc/rfc791.txt https://www.ietf.org/rfc/rfc1035.txt https://www.ietf.org/rfc/rfc1035.txt
    - johansch 11y ago
      Thanks :). So ~20 Gbit/s. (Also: I want your username.)
      - sjbase 11y ago
        You're definitely asking the right question, and IMO the answer is "sortof." It's not that impressive in the grand scheme of DDoS, given major attacks will sustain 100 gigabit traffic[1] sometimes for days on end. But 20gbit/s would likely be enough to take down a small & unprepared business. [1]: http://www.techworld.com/news/security/worlds-largest-ddos-attack-reached-400gbps-says-arbor-networks-3595715/ http://www.techworld.com/news/security/worlds-largest-ddos-a...
        meowface 11y ago
        20 Gbps definitely isn't very impressive given the current landscape, but it can probably take down many medium-sized businesses as well, if they have no DDoS mitigations. Even a large one, if they somehow had no mitigations or no decent security team.
        mirashii 11y ago
        20Gbps is actually still impressive if it is a set of valid requests like the parent seems to imply when doing the calculations. 20Gbps via a reflection technique is easy, but also relatively easy to filter and just requires a large pipe. 20Gbps of traffic doing legitimate requests that you can't immediately and trivially filter/rule out is still an impressive feat right now.

by robryk 11y ago

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).

comboy 11y ago

Well I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4

deleted 11y ago
[deleted]
johansch 11y ago
It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
- comboy 11y ago
  Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).
  - __jal 11y ago
    If this was a botnot, any one ISP is only seeing a tiny fraction of the load. Even if it were from a single source, it also isn't that hard to find an ISP that doesn't care. (They cost slightly more, but if you're a bad actor, presumably it is worth it.) Edit: "I think pretty much any ISP wouldn't let such packets through" If you google "BCP38", you will find well over a decade of network operators discussing specifically this topic and the reasons why ISPs (and other networks) don't, not to mention all the fun the kvetching and meta-kvetching that accompanies any technical discussion that's lasted so long.
    - cft 11y ago
      After you have been a target of ~50 Gbps NTP reflection attacks that nearly destroyed our company, it's hard to be impartial in these discussions.
      - cmdrfred 11y ago
        50gbps? Who did you piss off, damn.
  - r1ch 11y ago
    On residential ISPs it's generally not so easy, but I think pretty much every dedicated server provider I've used has allowed spoofed source IPs.
  - gcommer 11y ago
    It is, way too many ISPs still don't filter packets with obviously spoofed IP addresses. That said, even if the attackers in this event didn't spoof the IP address, they would almost certainly have still had a very wide distribution of addresses. > DNS root name servers that use IP anycast observed this traffic at a significant number of anycast sites. DNS root name servers are BGP anycasted: without knowing the maintenance routes, any packets you send will get routed to the topologically nearest instance. So, since the traffic source managed to hit multiple, geographically disperse anycast sites we can infer that they were able to generate traffic from worldwide traffic sources.
  - w8rbt 11y ago
    Yes, it is (especially UDP). Many networks still don't filter properly. "The solution to this problem, described in RFC2827, which was written some 13 years ago by Paul Ferguson and Daniel Senie, is to block IP packets entering the internet which have source IP addresses which are forged..." http://tools.ietf.org/html/rfc2827.html http://tools.ietf.org/html/rfc2827.html http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
  - kaeso 11y ago
    Reality check: ~30% of active AS worldwide don't drop spoofed packets originating from their networks. http://spoofer.cmand.org/summary.php http://spoofer.cmand.org/summary.php
    - tkinom 11y ago
      It is a bit like polluting the ocean by dumping wastes. It cost less for the polluters if they are not caught. For "typical AS router", is it easy or cheap to block spoofed packets? I wonder if that test software/website can/should "OUT / Shame" the AS routing subnets as "Major Internet Polluters" and publish a monthly reports to shame that 30% polluters.
  - dboreham 11y ago
    Certainly both our upstream providers allow through alien source address packets. This has caused me some head scratching on occasion, as in "how the #^$&#^ is this even working??". I suspect the reason is that it is non-trivial to collect and manage the list of kosher subnets once you exceed a certain size.
- js2 11y ago
  It's a 12 byte header + the query section, which is 4 bytes + the qname, a sequence of labels. Each label is a length octet + the ascii encoded characters of the label. A query for "us" would be 12 + 4 (02 75 73 00) + 4 = 20 bytes, plus the IP header (20 bytes) + the UDP header (8 bytes), so 48 bytes. https://www.ietf.org/rfc/rfc768.txt https://www.ietf.org/rfc/rfc768.txt https://www.ietf.org/rfc/rfc791.txt https://www.ietf.org/rfc/rfc791.txt https://www.ietf.org/rfc/rfc1035.txt https://www.ietf.org/rfc/rfc1035.txt
  - johansch 11y ago
    Thanks :). So ~20 Gbit/s. (Also: I want your username.)
    - sjbase 11y ago
      You're definitely asking the right question, and IMO the answer is "sortof." It's not that impressive in the grand scheme of DDoS, given major attacks will sustain 100 gigabit traffic[1] sometimes for days on end. But 20gbit/s would likely be enough to take down a small & unprepared business. [1]: http://www.techworld.com/news/security/worlds-largest-ddos-attack-reached-400gbps-says-arbor-networks-3595715/ http://www.techworld.com/news/security/worlds-largest-ddos-a...
      - meowface 11y ago
        20 Gbps definitely isn't very impressive given the current landscape, but it can probably take down many medium-sized businesses as well, if they have no DDoS mitigations. Even a large one, if they somehow had no mitigations or no decent security team.
        mirashii 11y ago
        20Gbps is actually still impressive if it is a set of valid requests like the parent seems to imply when doing the calculations. 20Gbps via a reflection technique is easy, but also relatively easy to filter and just requires a large pipe. 20Gbps of traffic doing legitimate requests that you can't immediately and trivially filter/rule out is still an impressive feat right now.