3 ms·
I am happy to see it go. For years I've had to block it in iptables using: iptables -t raw -I PREROUTING -i eth0 -p udp -m udp --dport 53 -m string --hex-
by LinuxBender 8y ago
I am happy to see it go. For years I've had to block it in iptables using:
iptables -t raw -I PREROUTING -i eth0 -p udp -m udp --dport 53 -m string --hex-string "|0000ff0001|" --algo bm --from 40 --to 65535 -j DROP
Most bots are poorly coded, so most of them don't try the individual records when ANY times out. ANY is also a decent generalized amplification attack vector. There are plenty of other ways to do amplification attacks, but this one is quite brain dead.
Thankyou to the folks at CloudFlare for submitting this.