bash-5.3:/# du -sh /var/log/pdns.log 
8.3G	/var/log/pdns.log

it seems that i forgot to disable verbose logging… in may #SERVFAIL

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like

Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning"

this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now.

anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32?

inet6num:       2a03:2880::/40
netname:        PRN
country:        US
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ASSIGNED
mnt-by:         fb-neteng
mnt-by:         facebook-neteng
created:        2020-03-11T00:33:38Z
last-modified:  2020-03-11T00:33:38Z
source:         RIPE

that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver

in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS

if you didn’t have enough reasons to hate meta: FUCK META

@domi today James opens a reasonably sized log file

@domi and they don’t even seed their torrents anyway —helene

@domi Wouldn't be surprised that once I move to a more reasonable ISP I'd just download their full-view and ban out Meta entirely, at least on the server side of things.

@domi What's the threshold for blackholing an AS?

@makdaam getting on my nerves REALLY badly. that /32 is all of their IPv6, I don’t want to bother with blocking all of their v4 too; since they were happy to send 270 connections to my pdns limited to 50 TCP conns, I think they literally won’t notice the block and will continue sending packets (i.e. they won’t fallback to IPv4, hopefully)

@domi i had the same thing happen to me an built a AS blochlist service, but using nftables😅

https://codeberg.org/stura-htw-dresden/stura-infra/src/branch/master/modules/isp-block.nix
Because the semrush but was alsmost worse for me😅

@domi They're not the first bigcorp to flood some service with requests. Google with goproxy DDoSing git repos is a good example from the past. All the AI crap is the most current one.

I'm wondering if having a community maintained prefix list or AS list to just drop is something that would be useful (prefixes probably more since most people can add firewall rules).

@domi This reminds me of Microsoft servers trying to scrape my website by trying to lookup weird urls: https://berkeley.edu.pl/notice/B3TdAoZFIHjCJa2dTE