rate-limit dns queries on Procurve 8212zl J9091A

[ghel]

Hi,

I had last week the situation that a user had a rouge dnsmasq which got our DNS server to its knees. I was looking arround how to rate-limit queries to our dnsmasq, with no success, neither on the server it self nor on the switch. Is there any way to do thi on a Procurve 8212zl / J9091A for each edge port the same way it can be achieved for ICMP, so that won't happen again? or is it a DNS specific configuration? 

Thanks

[TerjeAFK · Accepted solution]

There is a rate-limit comand on Procurve switches, but from what I know it is based on bandwidth and not number of packets so it may not be the solution to your problem. Otherwise I would say that this is something best handled by a firewall, to set limits on the number of simultaneous connections from a client to your DNS server.

[ghel]

Hi and thanks for the reply,

that is what I ended with. Unfortunately dnsmasq offers that option only for a specific domain, a specific Network or a specific single IP address. So the firewall does the job now.

cheers