The DMZ

2:39 AM

Hello~

Just a quick question: I'm running a recursive DNS, which is rate-limited to five queries per second to prevent DNS amplification attacks. I'm going to make this server public, so there will be a lot more DNS queries per second, but I still want to prevent DNS amplification. This is in my configuration:

rate-limit {
responses-per-second 5;
//other stuff below here that I won't paste into chat
};

Will that limit clients to five queries per second or will that limit _everyone_ to a collective maximum of five queries per second?

3:26 AM

@AustinBurk I think maybe your question would be just fine on SF.

I already tried, had a nice question set up too and _of course_ twenty-five minutes of stumbling through `man named`and Googling didn't give me the linked question when it was marked as a duplicate.

My question: http://serverfault.com/questions/585414/does-nameds-responses-per-second-rate-limit-option-limit-collective-queries-or

I deleted it but you should have enough rep to see it, looks like

@AustinBurk I do. In the question yours duplicated it gives you the answer: basically it limits the number of responses sent to each individual endpoint (not queries from!) to 5/sec.

eg. not a collective maximum

Yeah

And the `window 5` line? I don't have that, maybe I should
I'm new to named

3:45 AM

@AustinBurk I meant to say identical responses, though the actual meaning of identical is itself specific. You should read the docs: kb.isc.org/getAttach/91/AA-00845/Bv9ARM.pdf

(that is a way better doc than the manpage for named or named.conf)

window I think is a bursting window? shrug

let's take a look

yes, window is the number of seconds for which quota can be banked.

banked?

Ah, before the client can send any more DNS queries

@AustinBurk wait up I'm writing a better answer on the dupe.

@FalconMomot At least mine looked nicer

What the heck??!

Dangit Host1Plus!

brb

My VPS' internet connection likes to cut out every few weeks

It's not my fault

@AustinBurk Yes it is. Get a better host. :)

All my data's at Host1Plus

I signed onto their free vps service, my service got popular so I upgraded so they wouldn't kick me off

3:56 AM

@AustinBurk Erm, start getting the data out?

@TerryChia Yeah, and the system settings and apache, nginx, named, all those configs too

Set up just right...

@AustinBurk See, that's why those crap goes into chef/puppet/ansible scripts and into source control.

Except for iptables, I bought NAT support and it still doesn't let me do prerouting

@TerryChia Wat?

@AustinBurk puppetlabs.com

112 1 1 14

4:02 AM

@AustinBurk ?

@TerryChia I meant to look at my profile; I'm not really in any position to sign up for big expensive services; my own is costing me ~$140 a month already

@AustinBurk Dude, puppet is open source. So is chef and ansible. And $140/month for a VPS that loses internet connectivity every few weeks is ridiculous.

Errors since February 1st

@TerryChia nah, vps is only $8 a month plus the $10 I pay for backup 'slots' (2 of them), plus the NAT support and the extra IP address

http://www.sudomemo.net/
Ignore the bit about the proxy, that's changing to DNS soon, hence my questions
And I run most everything through a company called Fastly

@TerryChia oh hey, not bad

A: Bind DNS rate-limit and values for responses-per-second and window

0

You should read the administrator reference manual for BIND 9.9. Basically, responses-per-second is the number of identical replies that can be sent to one single destination, per second. The definitions are tricky. A single destination is a block of network addresses, of the size configured i...

2

@AustinBurk Ehh, you are getting shafted on bandwidth charges from a reportedly shitty company. That's like EC2 level prices right there.

4:13 AM

Nonono, that's the cost from Fastly
I get 2TB transfer from Host1Plus a month, but the bandwidth is the terrible part
Fastly is amazing: everything works great, they have integration for all sorts of stuff, great APIs, and live statistics to boot

@AustinBurk Ah. Do you need CDN level services? They are very expensive.

@TerryChia Yeah

What's the service for anyway?

There's this app for Nintendo DSi called Flipnote Studio, and you could make flipbook animations and stuff
It's pretty great

Anyways, you used to be able to post your Flipnotes to Flipnote Hatena - http://flipnote.hatena.com - but (follow the link)

So I've reverse-engineered it and made my own
And I'm finishing my senior year at high school too
Tough stuff

Let's put it in perspective: A flipnote can be, at maximum, ~900KB.
I started the service February 1st...and there's been 1349.434GB b/w usage since then

Monetize it better... $100 a month out of your own pocket isn't really sustainable....