dnsdist: Ponder dynamically blocking clients sending malformed packets

[rgacogne]

• Program: dnsdist
• Issue type: Feature request

Short description

At the moment a malformed packet does not make it to the in-memory ring-buffers, and thus we do not keep any data about them. It might make sense to keep track of these (in a separate ring buffer?) and add a new dynamic block rule to temporary block clients sending too many malformed packets.

Usecase

We have seen DDoS attacks sending malformed packets. DNSdist throws them away very quickly, but blocking the offending clients at eBPF level would be even better.