3 ms·
It would surprise me if cloudflare relied on blocking "ANY" for DDOS mitigation. Most modern resolver have builtin response rate limiting, and I would expect cl
by belorn 7y ago
It would surprise me if cloudflare relied on blocking "ANY" for DDOS mitigation. Most modern resolver have builtin response rate limiting, and I would expect cloudflare to have multiple additional mitigation methods to prevent malicious actors from exploiting their servers.
- kees99 7y agoIn a DNS-amplified DDoS attack, target (CF for example) would be on the receiving end (right-hand side of [1]), and blocking, while necessary, would not be terribly efficient there. On the other hand, deprecating "ANY" requests as standard, once percolated into BIND and other resolvers, would cut the attack[2] on the amplification stage (middle of the picture of [1]). [1] https://www.cloudflare.com/img/learning/ddos/dns-amplification-ddos-attack/dns-amplification-attack-1.png https://www.cloudflare.com/img/learning/ddos/dns-amplificati... [2] or at least significantly decrease choice and depth of large amplification factor requests available to the attacker.