<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thank you for your reply.<div>I'll look into RCRRL.</div><div>Im getting huge number of bogus requests that causing SERVFAIL like "snwjkjsdw.com" and so on, and thats why im trying to use RRL, <span style="font-size: 12pt;">all those requests are coming from my internal clients.</span></div><div>rnds status:</div><div><br></div><div><div>version: 9.9.4-RedHat</div><div>CPUs found: 48</div><div>worker threads: 48</div><div>UDP listeners per interface: 12</div><div>number of zones: 5</div><div>debug level: 0</div><div>xfers running: 0</div><div>xfers deferred: 0</div><div>soa queries in progress: 0</div><div>query logging is OFF</div><div>recursive clients: 870/99900/100000</div><div>tcp clients: 3/100</div><div><br></div></div><div><br></div><div>if you have any other idea to block such requests that would be helpful. <br><br>
<div class="ecxmoz-signature">-- <br>
<br>
<font color="#3366ff"><font color="#000000">Respectfully<b><br>
</b><b>Mahdi A. Mahdi</b></font></font><font color="#3366ff"><br><br></font><font color="#3366ff"></font></div><br><br><div>> Subject: Re: RRL BIND Recursive<br>> To: bind-users@lists.isc.org<br>> From: cathya@isc.org<br>> Date: Wed, 19 Oct 2016 10:05:10 +0100<br>> <br>> On 18/10/2016 07:37, Mahdi Adnan wrote:<br>> > Hi,<br>> > <br>> > I have a few servers running a recursive DNS bind service, i configured<br>> > one of the servers to limit the rate of requests.<br>> > my configuration is:<br>> > <br>> > rate-limit { log-only yes; errors-per-second 8; nxdomains-per-second 8;<br>> > ipv4-prefix-length 32;<br>> > <br>> > As soon as i apply these changes my server drop 90% of the requests<br>> > after a minute or two.<br>> > do you have any idea why is this happening ?<br>> > bind version is :<br>> > BIND 9.9.4-RedHat-9.9.4-29.el7_2.4<br>> <br>> This is a recursive server, so I think you've chosen the wrong tool -<br>> Response Rate Limiting (RRL) is applied to responses - so all of the<br>> work to get the response for a client is done before the rate limiting<br>> being applied - you want something that prevents that, not just the<br>> responses.<br>> <br>> Have a look a recursive client rate limiting instead:<br>> https://kb.isc.org/article/AA-01304<br>> <br>> (You're probably going to have to upgrade your BIND to get it).<br>> <br>> Moreover, you have "ipv4-prefix-length 32;" (the default is 24 and is 24<br>> for a reason - the overhead of managing all the rate limited buckets is<br>> going to be greater when you have more granularity.)<br>> <br>> I would guess that by adding RRL, even log-only, to a recursive server<br>> that is already under stress, that you've made it harder for it to<br>> function and have tipped it over the edge and you now have a build-up of<br>> recursive clients (backlog) to the point where named isn't able to<br>> respond to incoming queries quickly enough. It's also possible that<br>> your named isn't able to read queries from the UDP socket fast enough,<br>> and you have the buffer there overrunning and dropping queries.<br>> <br>> rndc status will show you if you're hitting the limit of recursive<br>> clients. If you are, increasing it probably isn't going to help you -<br>> you need to deal with why you have the backlog (but having a limit that<br>> is bigger than 1000 will get you a soft limit as well as a hard limit,<br>> so reaching the limit should cause SERVFAIL rather than drops).<br>> <br>> Cathy<br>> <br>> <br>> _______________________________________________<br>> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list<br>> <br>> bind-users mailing list<br>> bind-users@lists.isc.org<br>> https://lists.isc.org/mailman/listinfo/bind-users<br></div></div> </div></body>
</html>