3 ms·
Was that the bit about amplification via DNSSEC?
by count 14y ago
Was that the bit about amplification via DNSSEC?
- ibotty 14y agoi'm pretty sure it was. but he has been telling the world about dnssec amplification for years now, so this is hardly news.
- belorn 14y agoThe amplification is by asking the misconfigured resolver about a DNSSEC zone. Basically, DNSSEC just mean you do not need to search the for a large zone to request. Given that large zones are not directly in shot supply, and that searching for them is (in the age of ipv4) rather easy, I wonder if DNSSEC actually have any affect on the issue what so ever.
- smountcastle 14y agoDNSSEC-signed responses can be very large. Here's an example of turning a 31 byte request into a 3974 byte response: http://dnscurve.org/amplification.html http://dnscurve.org/amplification.html That's ~128x amplification -- with a 100Mbps connection, roughly 12.8Gbps of responses would be sent to the forged IP source.