Re: query for unknown domain hangs

Tony Primerano wrote:
> If I do a dig command against my djbdns name server for a domain that I 
> don't have configured, the dig command hangs for about 15 seconds.
> 
> dig @ns1.mynameserver,com somedomain.com <http://somedomain.com>
> 
> Could this be used for a DoS attack (use up all connections while the 
> nameserver sits on the requests) or does UDP not have this issue (sorry 
> for my ignorance here,  its been years since I dealt with UDP)

UDP doesn't have "connections" as such, and this query isn't tying up 
anything but a small amount of bandwidth: djbdns simply discards any 
queries for a domain it isn't responsible for. Essentially, dig sends a 
query (one UDP packet), djbdns sees it isn't for a domain djbdns is 
handling and so discards it, dig gets no reply so it tries again, and 
again, then gives up after 15 seconds. All it's really using is a 
kilobyte or two of bandwidth with the queries djbdns is discarding.

It could be used for a very crude DoS attack, simply flooding the server 
with irrelevant queries (as indeed has been done on a few big sites in 
recent years, knocking Yahoo and co offline with gigabits of junk), but 
there is nothing any software can do about that: djbdns is no more 
vulnerable to this than any other server, and less so than most since it 
discards the junk queries very efficiently.


James.