Re: Possible Denial Of Service using DNS

[marka () ISC ORG (marka () ISC ORG)]

> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_0018_01BEE35A.297221E0
> Content-Type: text/plain;
>       charset="iso-8859-1"
> Content-Transfer-Encoding: 8bit
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> I must admit that I have been really surprised seeing people's
> 'reaction'
> on this particular matter. We are used to see really good debates when
> something 'c00l' comes up to the scene... But this time, nothing: no
> code review, no debate about possible solutions, ... :?.

        The only real solution is to have ISP actually police the
        source addresses of packets entering their networks from
        their customers.  There is nothing new here.  Good ISP's
        do this already, bad ones don't.  The best ones will even
        notify the customers that they have a problem when they
        see attacks like this lauched from within the customer's
        network.

        Mark

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka () isc org