<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">
<div>Apologies. The intent is to drop inbound AAAA queries from the internet.</div>
<div><br>
</div>
<div id="x_signature-x" style="">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a></div>
</div>
<div id="x_quoted_header" style="clear:both"><br>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<span style="font-size:11.0pt; font-family:'Calibri','sans-serif'"><b>From:</b> Mark Andrews <marka@isc.org><br>
<b>Sent:</b> May 16, 2016 3:41 PM<br>
<b>To:</b> John W. Blue<br>
<b>Cc:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: New type of DDoS? Anyone saw it?<br>
</span></div>
</div>
<br type="attribution">
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText"><br>
In message <e7f58592-1570-494f-a530-97e54b8c04cf@rrcic.com>, "John W. Blue" writes:<br>
><br>
> Hello Marek,<br>
><br>
> Do you have an IPv6 assignment? If not, there is really no need to even<br>
> be resolving AAAA records. An overly simplistic description of a<br>
> potential solution could be to just drop the incoming AAAA request via<br>
> its hex value in much the same way rate limiting is done for the "any"<br>
> query:<br>
><br>
> -hex-string '|0000FF0001|'<br>
><br>
> I don't know off hand what the hex value for AAAA is but it should not be<br>
> too hard to find.<br>
><br>
> John<br>
<br>
Just dropping AAAA queries is a bad idea as most machines actually<br>
have a AAAA addresses (loopback and linklocal) so just about every<br>
application makes AAAA queries. If you drop AAAA queries you slow<br>
up every address lookup in your network.<br>
<br>
Mark<br>
-- <br>
Mark Andrews, ISC<br>
1 Seymour St., Dundas Valley, NSW 2117, Australia<br>
PHONE: +61 2 9871 4742 INTERNET: marka@isc.org<br>
</div>
</span></font>
</body>
</html>