Alarming number of DNS requests made by iOS devices

Re:Alarming number of DNS requests made by iOS devices by cbanek on Saturday October 21, 2017 @09:24PM (#15524608)

Since you're blocking some DNS requests, do you think a portion of the usage might be retries? If one DNS request could turn into querying all the addresses in your list, I could see an amplification attack happening, and then that happening also on a retry. Look for patterns in querying the individual names?

[ Parent | on HN ]

Re:Alarming number of DNS requests made by iOS devices by stanlarroque on Saturday October 21, 2017 @09:27PM (#15524620)

I do not block these requests. However I am pretty sure Apple does some DNS tunneling.

Also, some iOS specific requests happen when there is no other DNS activity at all.

[ Parent | on HN ]

Re:Alarming number of DNS requests made by iOS devices by cbanek on Saturday October 21, 2017 @09:32PM (#15524638)

> However I am pretty sure Apple does some DNS tunneling.

That seems very reasonable. It would be better than hardcoding IP addresses and safer than straight DNS for management things. Maybe their implementation of that doesn't have a very long TTL?

[ Parent | on HN ]