[ratelimits] rrl mention in an nlnetlabs tech report
olaf at NLnetLabs.nl
Fri Aug 23 08:01:24 UTC 2013
On 22 aug. 2013, at 20:02, Paul Vixie <paul at redbarn.org> wrote:
> saw this:
>> Another pro-active technique is Response Rate
>> Limiting (RRL) . It limits the number of unique
>> responses sent by the authoritative server. Roughly,
>> it works by keeping track of of several pieces of
>> information of the responses. With every subsequent
>> request, the name server checks whether the
>> response that would be sent exceeds the set limit
>> of responses per second per set of information. If
>> this is the case, it either responds only once in a
>> number of queries (conﬁgurable) or it sends a
>> truncated (TC-ﬂag set) answer, forcing a legitimate
>> resolver to retry the query over TCP. RRL is currently
>> the most promising technique and is implemented
>> in the most popular name server software like
>> BIND , NSD  and Knot . The effectiveness
>> of RRL is debated, it stops unsophisticated
>> attacks using reﬂection.
Made by one of our interns.
I wonder if you wanted to express something more than "look at this" with the specific quote?
PS. other related intern work: http://www.nlnetlabs.nl/downloads/publications/report-rrl-dekoning-rozekrans.pdf
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
More information about the ratelimits