Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: Who is Dean Anderson?
Matthew Dempsky <[email protected]>
| Newsgroups | gmane.network.djbdns |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Mar 11, 2010 at 3:13 PM, Dean Anderson <[email protected]> wrote: > Yes there is a time restriction There is a time restriction on how long before an outstanding query receives a legitimate response packet, but that only affects how many queries an attacker has to send to dnscache to keep it maxed out on duplicate outstanding queries. E.g., if queries receive a response on average in 100ms, then an attacker has to send an average of 2000 queries per second to keep dnscache at 200 concurrent outstanding queries; if it's 50ms, then it takes 4000 queries per second; if it's 200ms, then it takes only 1000 queries per second. However, this has no impact on the expected number of forged response packets needed before success, or on how long an attacker can sustain an attack.