3 ms·
DNS is far from perfect, TLDs are stupid and always have been, the arbitrary rules for records are stupid, MX records are ridiculous, UDP size constraints on an
by liveoneggs 5y ago
DNS is far from perfect, TLDs are stupid and always have been, the arbitrary rules for records are stupid, MX records are ridiculous, UDP size constraints on answers.. nevermind I could keep going. DNS sucks.
- cookiengineer 5y agoAlso: DNS resolvers and ISPs are the reason for amplification attacks. ISPs should simply check where the UDP traffic is coming from, and filter out packets that have a different UDP source address inside them. This would literally make the internet DDoS free.
- schoen 5y agoThere are DDoSes that are based on botnets without specifically relying on amplification or reflection. There have even been DDoSes relying on user-contributed resources: https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon Amplification makes a DDoS bigger, but isn't what makes it a DDoS.
- cookiengineer 5y ago> Amplification makes a DDoS bigger, but isn't what makes it a DDoS. I know, but large botnets like MIRAI and similar usually take advantages of how UDP flooding works, because TCP RST packets don't scale as well. I was just mentioning that because ISPs could easily get rid of most UDP-based DDoS attacks if they would watch their networks' packet sources (what they're doing anyways). Usually it's literally just a comparison of IANA assigned IP ranges (of source+victim being inside or outside), and if they're mismatching, it's very likely to be a UDP flooding attack.