Subject: EDNS0 traffic amplification attacks in the wild

From: Florian Weimer <[email-masked]>
Date: Wed, 30 Nov 2005 10:35:35 +0100

There are some reorts on BUGTRAQ which indicate that open resolvers
with EDNS0 support are now abused for traffic amplification purposes:

  <http://marc.theaimsgroup.com/?t=113320946500009&r=1&w=2>

(The posted packet capture contains an OPT RR with a buffer size of
10000.)

I know that people generally think this is a non-issue because you
should offer resolver service to the Internet at large anyway, but I'm
reporting this here in case anyone is working on RFC 2671bis and wants
to include an updated Security Considerations section.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 30 Nov 2005 21:43:51 +1100

> to include an updated Security Considerations section.

	Just another reason to deploy BCP38 everywhere.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]