Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt

[Ron Bonica <rbonica at juniper.net>]

Dean,

Thanks for this proposal. At his point, I will sit quietly for a while
and let the WG comment on whether they think that your proposed
alternative mitigation is adequate. On Friday, the WG chairs will gauge
consensus and I will take appropriate action.

                              Ron


Dean Anderson wrote:

> 
> Mitigation of open resolver attacks is well described, both by BCP38 and 
> by the previous comparision with the more damaging DNS attack.
> 
> If one is attacked by open recursors, the mitigation during the attack
> is to filter the packets from the open recursors during the attack.  
> Filtering open recursors usually has little or no damage to either the
> recursor operator or the target of the attack. This is the typical
> response by ISPs to all kinds of packet flooding attacks. There is
> nothing special about open recursor attacks that requires any kind of
> special handling.
> 
> 		--Dean
_______________________________________________
DNSOP mailing list
DNSOP at ietf.org
https://www.ietf.org/mailman/listinfo/dnsop