This is a multi-part message in MIME format.

------=_NextPart_000_0012_01C657D4.207A3140
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

> -----Original Message-----
> From: Geo. [mailto:geoincidents@nls.net]
> Sent: April 2, 2006 10:31
> To: bugtraq@securityfocus.com
> Subject: Re: recursive DNS servers DDoS as a growing DDoS problem
>
> > 1. Resolvers and Authoritative nameservers must be separate and
> > authoritative nameservers must have recursion turned off. Otherwise
> > there is no way to throttle only recursive queries.
>
> Great, for small ISP's you just doubled the number of
> machines they need to
> dedicate to DNS.

They can run both recursive and authoritative DNS on the same server using
different IP address.

> > 2. In a smaller ISP the nameservers themselves can get an
> aggregate of
> > the ISP routing table and have internal routes tagged accordingly so
> > that the DNS server can throttle them. No rocket science there, the
> > provisions are already available in every single OS in use as a DNS
> > server in ISPs/Telcos. All this requires is a moderate level of
> > competence in the person who has designed the service.
>
> Really? Ok educate me, how do you do this with Windows 2000
> running MS dns?
> (telling people to use another server is not acceptable)
>
> Geo.
>

If Microsoft's products are broken, why souldn't I tell people to use
something else?

Thomas

------=_NextPart_000_0012_01C657D4.207A3140
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIIwTCCAkkw
ggGyoAMCAQICAw+pBzANBgkqhkiG9w0BAQQFADBiMQswCQYDVQ QGEwJaQTElMCMGA1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVG hhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0EwHhcNMDUxMDEzMjE1NDQ2WhcNMDYxMD EzMjE1NDQ2WjBCMR8wHQYDVQQD
ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMR8wHQYJKoZIhvcNAQ kBFhB0aG9tYXNAemFuZ28uY29t
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpO58O2SQ+zn xpvrbDsmLxepJzdphhREbvvU23
0jSS4DatcJo1W0r7FN56SmI1Bns0QQz/mKUxkbwSDtV3VURwhUtOjgM/mps1SK155dOCMCNCMVMM
S01a+qp+rdJeOhqOBWXsDoKRtln9m+rPsc5WN4eDblF6PMVmt9 gS5eQXyQIDAQABoy0wKzAbBgNV
HREEFDASgRB0aG9tYXNAemFuZ28uY29tMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEA
iTlTfST/7iXV8mtlka52jxntFPBTbAoOvATjBaj8VvX/sQ6/53OUsxOsHp+UBIXsQ6FJcC/ggXLw
wfreP2FUZ6xuFRjXpq3zGADlv08yHqcsf0vJct974jsM6r/LenC7xhrn5Q7f5JKSnWbZvttbATvj
Z/VMG+TYf3RhQefdiaAwggMtMIIClqADAgECAgEAMA0GCSqGSIb3 DQEBBAUAMIHRMQswCQYDVQQG
EwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEw lDYXBlIFRvd24xGjAYBgNVBAoT
EVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2 F0aW9uIFNlcnZpY2VzIERpdmlz
aW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haW wgQ0ExKzApBgkqhkiG9w0BCQEW
HHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNOTYwMT AxMDAwMDAwWhcNMjAxMjMxMjM1
OTU5WjCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm 4gQ2FwZTESMBAGA1UEBxMJQ2Fw
ZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMC YGA1UECxMfQ2VydGlmaWNhdGlv
biBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIF BlcnNvbmFsIEZyZWVtYWlsIENB
MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aG F3dGUuY29tMIGfMA0GCSqGSIb3
DQEBAQUAA4GNADCBiQKBgQDUadfUsJRkW3HpR9gMUbbqcpGwhF 59LQ2PexLfhSV1KHQ6QixjJ5+V
e0vvfhmHHYbqo925zpZkGsIUbkSsfOaP6E0PcR9AOKYAo4d49v mUhl6t6sBeduvZFKNdbnp8DKVL
VX8GGSl/npom1Wq7OCQIapjHsdqjmJH9edvlWsQcuQIDAQABoxMwETAPBg NVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBBAUAA4GBAMfskn5O+PWWpWdiKqTwTRFg0G +NYFhhrCa7UjVcCM8w+6hKloof
YkIjjBcP9LpknBesRynfnZhe0mxgcVyirNx54+duAEcftQ0o6A Kd5Jr9E/Sm2Xyx+NxfIyYJkYBz
0BQb3kOpgyXy5pwvFcr+pquKB3WLDN1RhGvk+NHOd6KBMIIDPz CCAqigAwIBAgIBDTANBgkqhkiG
9w0BAQUFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3 Rlcm4gQ2FwZTESMBAGA1UEBxMJ
Q2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZz EoMCYGA1UECxMfQ2VydGlmaWNh
dGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3 RlIFBlcnNvbmFsIEZyZWVtYWls
IENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbE B0aGF3dGUuY29tMB4XDTAzMDcx
NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWk ExJTAjBgNVBAoTHFRoYXd0ZSBD
b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZS BQZXJzb25hbCBGcmVlbWFpbCBJ
c3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ DEpjxVc1X7TrnKmVoeaMB1BHCd
3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/cVbLrzwLB+fxH5E2
JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8YQRAHmQZcmC3 +wIDAQAB
o4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2N ybC50
aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5jcm wwCwYDVR0PBAQDAgEGMCkGA1Ud
EQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwyLTEzOD ANBgkqhkiG9w0BAQUFAAOBgQBI
jNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSx
mRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowgT2Vfldr394fWxg hOrvbqNOUQGls1TXfjViF4gtwh
GTXeJLHTHUb/XV9lTzGCAs8wggLLAgEBMGkwYjELMAkGA1UEBhMCWkExJTAjBg NVBAoTHFRoYXd0
ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYX d0ZSBQZXJzb25hbCBGcmVlbWFp
bCBJc3N1aW5nIENBAgMPqQcwCQYFKw4DAhoFAKCCAbwwGAYJKo ZIhvcNAQkDMQsGCSqGSIb3DQEH
ATAcBgkqhkiG9w0BCQUxDxcNMDYwNDA0MTQ0MDAxWjAjBgkqhk iG9w0BCQQxFgQUM4J5hBUQSod3
CWzI1rjlwrVBYsowZwYJKoZIhvcNAQkPMVowWDAKBggqhkiG9w 0DBzAOBggqhkiG9w0DAgICAIAw
DQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICAS gwBwYFKw4DAhowCgYIKoZIhvcN
AgUweAYJKwYBBAGCNxAEMWswaTBiMQswCQYDVQQGEwJaQTElMC MGA1UEChMcVGhhd3RlIENvbnN1
bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcn NvbmFsIEZyZWVtYWlsIElzc3Vp
bmcgQ0ECAw+pBzB6BgsqhkiG9w0BCRACCzFroGkwYjELMAkGA1 UEBhMCWkExJTAjBgNVBAoTHFRo
YXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1 RoYXd0ZSBQZXJzb25hbCBGcmVl
bWFpbCBJc3N1aW5nIENBAgMPqQcwDQYJKoZIhvcNAQEBBQAEgY CaVFNy7KPGTKHVtUa8dGE29Tty
7g5z6/kD/jg8Olghd4kHfW/hEyqEInzs8Ca5n/llmk0ouxgRZvFz5xU3EX7SpxIV2UAqzHVMLwyJ
gwWSgDlxDxMwSn/SKoi3u/R1dEpCDkvLwgtHLlNTvtsNrIGRzVT3/D+CK1uYR3OKob2NTwAAAAAA
AA==

------=_NextPart_000_0012_01C657D4.207A3140--