Dns Client Verification - HP MSR Series Configuration Manual

Figure 148 TCP proxy in SYN cookie mode

DNS client verification

The DNS client verification feature protects DNS servers against DNS flood attacks. It is configured
on the device where packets from the DNS clients to the DNS servers pass through. The device with
DNS client verification feature configured is called a DNS client authenticator.
As shown in
1. Upon receiving a UDP DNS query destined for a protected server, the DNS client authenticator
responds with a DNS truncate (TC) packet. The DNS truncate packet requires the client to
initiate a query in a TCP packet.
2. When the authenticator receives a DNS query in a TCP SYN packet to port 53 from the client,
the authenticator responds with a SYN-ACK packet.
3. When the authenticator receives a RST packet from the client, the authenticator verifies the
client as legitimate.
4. The authenticator adds the client's IP address to the trusted IP list and forwards the trusted
client's subsequent packets to the server.
Figure 149 DNS client verification process
The DNS client verification feature requires that clients use the standard TCP/IP protocol suite and
DNS protocol. Legitimate clients that use non-standard protocols will be verified as illegitimate by the
DNS client authenticator.
With client verification, the first DNS resolution takes more time than normal DNS resolution.
Figure 149, the DNS client verification functions as follows:
487