<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt'>
<p> </p>
<p> </p>
<p>On 27/05/2015 07:00, Mike Hoskins (michoski) wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Hi folks,<br /><br /> I've read about RRL with interest since its inception, but just now<br /> getting around to rolling it out. That is partially because we run a very<br /> small authoritative infrastructure serving mostly as Akamai EDNS origins.<br /> However, since it is exposed externally, used by a few tenants and RRL has<br /> been running in the wild for awhile now...we decided to finally hop on the<br /> bandwagon as part of our latest round of DNS infrastructure upgrades.<br /><br /> We are experimenting in log-only mode, and wanted to get feedback on<br /> settings which work well for others in production. So far we have the<br /> following which appears to work well (not limiting typical clients during<br /> normal operation):<br /><br /> rate-limit {<br /> log-only yes;<br /> ipv4-prefix-length 32;<br /> window 10;<br /> responses-per-second 20;<br /> nxdomains-per-second 10;<br /> exempt-clients {<br /> [...]<br /> };<br /><br /><br /><br /><br /> };<br /><br /><br /> However, as we've mostly just been turning knobs in an attempt to minimize<br /> log entries... insight from operators is appreciated.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
</blockquote>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Looks good, its pretty close to what I use, however one thing to consider (maybe you have) is the ipv6 prefix, its default from memory is 56, in Australia, the typical assignments for those few ISP's issuing IPv6, is /64, so I set "ipv6-prefix-length 64", but depends on geographic's I suppose, maybe if your traffic is mostly U.S. and if the average U.S. ISP dishes out /56's, it doesn't matter much to change it.<br /><br /> Cheers<br /><br /></div>
</body></html>