<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,
<div><br>
</div>
<div>I would like to consult dynamic rules behavior.</div>
<div>I run dnsdist 1.6.1 on Debian and I have folloving rules set:</div>
<div>#####</div>
<div>local dbr = dynBlockRulesGroup()</div>
<div>dbr:setRCodeRate(DNSQType.TXT, 25, 30, "Exceeded TXT rate", 60)</div>
<div>dbr:setRCodeRate(DNSRCode.NXDOMAIN, 20, 10, "Exceeded NXDomain rate", 60)</div>
<div>dbr:setRCodeRate(DNSRCode.SERVFAIL, 20, 10, "Exceeded ServFail rate", 60)</div>
<div>dbr:setQTypeRate(DNSQType.ANY, 3, 10, "Exceeded ANY rate", 60)</div>
<div>dbr:setResponseByteRate(30000, 10, "Exceeded responses bps rate", 60)</div>
<div>dbr:setQueryRate(100, 10, "Exceeded query rate", 60, DNSAction.Drop, 80)</div>
<div><br>
</div>
<div>function maintenance()</div>
<div> dbr:apply()</div>
<div>end</div>
<div>#####</div>
<div><br>
</div>
<div>There is a client which sends continuously DNS traffic like this:</div>
<div>src.ip.of.cnt - source IP of a client</div>
<div>dst.ip.of.srv - destination IP of my dnsdist server</div>
<div>##### tcpdump #####</div>
<div>11:34:02.000372 IP src.ip.of.cnt.49152 > dst.ip.of.srv.53: 0+ A? imap@somedomain.com. (36)</div>
<div>11:34:02.000474 IP dst.ip.of.srv.53 > src.ip.of.cnt.49152: 0 NXDomain 0/1/0 (100)</div>
<div>11:34:02.006126 IP src.ip.of.cnt.49152 > dst.ip.of.srv.53: 0+ A? imap@somedomain.com. (36)</div>
<div>11:34:02.006246 IP dst.ip.of.srv.53 > src.ip.of.cnt.49152: 0 NXDomain 0/1/0 (100)</div>
<div>...cut...</div>
<div>11:34:02.989632 IP src.ip.of.cnt.49152 > dst.ip.of.srv.53: 0+ A? imap@somedomain.com. (36)</div>
<div>11:34:02.989716 IP dst.ip.of.srv.53 > src.ip.of.cnt.49152: 0 NXDomain 0/1/0 (100)</div>
<div>11:34:02.992114 IP src.ip.of.cnt.49152 > dst.ip.of.srv.53: 0+ A? imap@somedomain.com. (36)</div>
<div>11:34:02.992172 IP dst.ip.of.srv.53 > src.ip.of.cnt.49152: 0 NXDomain 0/1/0 (100)</div>
<div>##### end of tcpdump #####</div>
<div><br>
</div>
<div>There is more than 120 qps and all the queries end with "NXDomain" response.</div>
<div>If I read my dynamic rules from top, I think, this client should be trapped by "DNSRCode.NXDOMAIN" rule,</div>
<div>which is more strict for this case, but the client is usually trapped by "QueryRate" rule.</div>
<div>Why it is so?</div>
<div><br>
</div>
<div>Regards</div>
<div><br>
</div>
<span>John Littlekate</span><br>
</div>
</body>
</html>