Dnsdist is bypassing some traffic that must be blocked

[ahmedhkhalil]

Dears,
we have some blocking roles based on number of nxdomain responses from NS server configure on dnsdist , what we have discoverred is that most of IPs is blocked , but some of them is not blocked despite when check logs found that they hit limit and must be blocked , how to troubleshoot that may i know if there is limit on how many IPs by default dnsdist should block

[rgacogne]

Please share the version of dnsdist that you are using, the configuration and the logs showing the issue, otherwise there is nothing we can do to help you.

[ahmedhkhalil]

dnsdist 1.8.4

[ahmedhkhalil]

below image show number of requests that has been recieved at assoicated PowerDNS authroties server from only one of our DNsdist server as you can see that number of requests is larger than 2 and also during 20 seconds we exceed 6 requests , so according to our threshold it must be blocked since minute 1

[rgacogne]

Please share your configuration, otherwise there is no way for us to know what you are trying to achieve and whether this is working as expected.

[ahmedhkhalil]

below is sample of role that must hit
dbr:setRCodeRate(DNSRCode.NXDOMAIN, 4, 20, "exceeding", 70000 ,DNSAction.Drop, 3)****

[rgacogne]

Please don't do this: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open If you don't give us the full configuration we are spending a lot of time guessing, and this means wasting our time and yours.