Re: DNSBL mirror inquiry

Alica CCS wrote:
> The server located at 163.25.104.5 once worked in April, but in May the 
> server's network session load grew to a level that our NAT equitment 
> cannot sustain. Because we have more computers than our ips, we need to 
> maintain a NAT block which covers our whole campus, including about 30 
> class C public ip blocks and about 100 class C private ip blocks.
> 
> The situation is the person who manages our outbound connection and NAT 
> devices insisted that the sessions should below the alarm level of NAT, 
> or he will block all DNS query sessions to 163.25.104.5 and reserve 
> sessions for ordinary use. Surely our service cannot affect the whole 
> campus, and we didn't find any measure to rate limit the sessions to our 
> server. The server is still running, but massive requests to it made it 
> unaccessible from outside network--- it's a pity that we cannot sustain 
> the load.

Note that there was NO queries made to your server, except of
very few per several minutes done by DSBL robot that generates
http://dsbl.org/nsstatus page.  Your nameserver has never been
in production, so whatever caused those queries was NOT due to
DSBL services.  Your server has been in "watching" list only,
to see, before putting it into official list, if updates etc are
performed correctly.

Also, NAT does not apply in this case, or should not be.  That is,
for such a task as DSBL nameserver, the machine in question should
not be behind any NAT box, partly for the load reasons, and also
because NAT will place huge additional and unnecessary overhead
(for a machine with such a load, it should be Ok to place it before
any NATs).

Another note is that by "NAT", people usually mean "SNAT", or
"masquerade", that is, so that internal machines on LAN will be
able to connect to the outside world, but not the reverse (SNAT
stands for Source NAT, ie, when a packet goes out from private
IP address, it's source is being replaced (masqueraded) by the
gateway box).  In order for any machine on private LAN to be
reachable from outside network, another sort of NAT takes place,
called "DNAT" (from Destination), or port-forwarding.

> Do you have any idea to rate limit the queries? If not, then we have no 
> other choices but only resign to be a official DSBL mirror. Sorry for 
> the inconveniences.

There's no way to limit number of queries without making the service
somewhat useless.  Typical public DSBL nameserver receives about
1000..2000 queries per second.

/mjt

----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].