Re: DNS noise

[Nick Hilliard <nick () foobar org>]

On 06/04/2012 18:41, Nathan Eisenberg wrote:
> Anyone else seeing this sort of noise lately?

There has been a bit of that recently for ripe.net and several other well
known DNSSEC enabled domains (e.g. isc.org).

It turns out that DNSSEC makes a respectable traffic amplification vector:

> twinkie# dig +ignore +notcp any ripe.net | grep rcvd
> ;; MSG SIZE  rcvd: 490
> twinkie#

The dns request packet size was 26 bytes.  Add packet overhead to both the
request and the reply, and you end up with:

request: 26 (data) + 8 (udp) + 20 (ip) + 18 (ethernet frame) + ipg (12) + 8
(preamble) = 92
reply: 490 (data) + 8 (udp) + 20 (ip) + 18 (ethernet frame) + ipg (12) + 8
(preamble) = 556

=> amplification on ethernet medium == 556/92, or slightly more than 6x.

Welcome back to the 1990s.

Nick