Conversation

Notices

1. Embed this notice
   famfo :riesifrogSnowman: (famfo@frogs.lgbt)'s status on Sunday, 14-Sep-2025 07:14:25 JST famfo :riesifrogSnowman:

   Today in doing authoritative DNS: amplification attacks

   I guess at least we now know what the spikes in our monitoring are :riesiupsideDownFrog:

   #servfail

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     famfo :riesifrogSnowman: (famfo@frogs.lgbt)'s status on Sunday, 14-Sep-2025 07:14:37 JST famfo :riesifrogSnowman:

     in reply to

     Almost one million ANY queries to a single domain just on ONE server in ~1-2 minutes. Either someone is very insistent on getting a response to ANY over UDP or they just want us to generate traffic.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 14-Sep-2025 07:15:14 JST Haelwenn /элвэн/ :triskell:

     in reply to
     @famfo Was that more queries than when poll-over-DNS happened?
   • Embed this notice
     famfo :riesifrogSnowman: (famfo@frogs.lgbt)'s status on Sunday, 14-Sep-2025 07:15:38 JST famfo :riesifrogSnowman:

     in reply to

     • Taavi Väänänen

     @taavi ah damn, how could we

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Taavi Väänänen (taavi@wikis.world)'s status on Sunday, 14-Sep-2025 07:15:39 JST Taavi Väänänen

     in reply to

     @famfo did you forget to block traffic with the evil bit set?

   • Embed this notice
     famfo :riesifrogSnowman: (famfo@frogs.lgbt)'s status on Sunday, 14-Sep-2025 08:01:20 JST famfo :riesifrogSnowman:

     in reply to

     • Haelwenn /элвэн/ :triskell:

     @lanodan the peak, yup

     Haelwenn /элвэн/ :triskell: likes this.