<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">
<div>Hello Marek,</div>
<div><br>
</div>
<div>Do you have an IPv6 assignment? If not, there is really no need to even be resolving AAAA records. An overly simplistic description of a potential solution could be to just drop the incoming AAAA request via its hex value in much the same way rate limiting
is done for the "any" query:</div>
<div><br>
</div>
<div>–hex-string '|0000FF0001|'<br>
</div>
<div><br>
</div>
<div>I don't know off hand what the hex value for AAAA is but it should not be too hard to find.</div>
<div><br>
</div>
<div>John</div>
<div><br>
</div>
<div id="x_signature-x" style="">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a></div>
</div>
<div id="x_quoted_header" style="clear:both"><br>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<span style="font-size:11.0pt; font-family:'Calibri','sans-serif'"><b>From:</b> Marek Królikowski <admin@wset.edu.pl><br>
<b>Sent:</b> May 16, 2016 10:04 AM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> New type of DDoS? Anyone saw it?<br>
</span></div>
</div>
<br type="attribution">
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hello,<br>
Today i saw my bind eat almost 90% of RAM when i check logs I find<br>
interesting DDoS on my DNS Cluster today:<br>
16-May-2016 16:47:47.467 client 8X.1X0.3Y.40#44968: query: 323.016.231.212<br>
IN AAAA + (8X.1X0.Y.Y)<br>
16-May-2016 16:47:47.467 client 8X.1X0.3Y.40#44968: slip response to<br>
8X.1X0.33.0/24 for . IN AAAA (00000000)<br>
16-May-2016 16:47:47.467 client 8X.1X0.3Y.40#38600: query: 235.326.031.064<br>
IN AAAA + (8X.1X0.Y.Y)<br>
16-May-2016 16:47:47.467 client 8X.1X0.3Y.40#38600: drop response to<br>
8X.1X0.33.0/24 for . IN AAAA (00000000)<br>
16-May-2016 16:47:47.467 client 8X.1X0.3Y.40#51399: query: 331.206.372.214<br>
IN AAAA + (8X.1X0.Y.Y)<br>
16-May-2016 16:47:47.467 client 8X.1X0.3Y.40#51399: slip response to<br>
8X.1X0.33.0/24 for . IN AAAA (00000000)<br>
<br>
Looks like IN AAAA query about wrong IPv4 address... i got almost 5000/sec<br>
Anyone saw this too?<br>
<br>
Best Regards<br>
Marek<br>
<br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font>
</body>
</html>