4 ms·
> Most web-based services don't need random UDP packets from the internet. HTTP3 is UDP-based. If you're running a modern web service, blocking UDP isn't a via
by duskwuff 2y ago
> Most web-based services don't need random UDP packets from the internet.
HTTP3 is UDP-based. If you're running a modern web service, blocking UDP isn't a viable option.
> DNS and NTP can use TLS, etc.
No, they can't. DoH is only used for recursive resolvers (like those operated by ISPs); if you want to run an authoritative DNS server for your domain, you still need to respond to queries on UDP port 53. NTS (RFC 8915) still uses UDP for time synchronization packets; only the initial key exchange is over TCP.
- musicale 2y agoGood points; however, 1) many victims are not running http3 and 2) there are ways of addressing the cases you mention, such as dropping unauthenticated TLS traffic, isolating any external-facing DNS and NTP servers (and probably with whitelisting/sandboxing/time-windowing), etc. (I'm also not a fan of abusing DNS for load balancing, but that is another discussion.) All of this can be done in hardware at line rate. And source address validation is going to help as well. I'd be interested in your ideas as to the best steps forward for improving the DDoS situation, if you have a reference.
- karlgkk 2y agobetween 20%-60% of internet traffic today uses quic/http3 (udp). depends on many factors. so like... many victims, even the majority maybe, are using udp. and the solutions you suggested are either non-starters for various reasons, or already being done and considered table stakes
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- musicale 2y ago40% to 80% solution would be very significant. If source address validation is already being done, shouldn't it block reflection attacks that depend on source address spoofing?