Suspicious DNS activity

[Jason Richardson <A00JER1 () WPO CSO NIU EDU>]

Has anyone else seen dramatically increased DNS PTR look-ups over the
past couple of days?  At one point our DNS servers were almost
overwhelmed with the number of PTR look-ups.  At the same time we were
seeing an abnormally large number of SMTP connections but that is
probably attributed to increased virus activity.  The number has dropped
off some but we continue to see excessive look-ups compared to our
normal volume of DNS traffic.

Thanks,

---
Jason Richardson, J.D., CISSP, CISM, CNE
Manager, IT Security and Client Development
Enterprise Systems Support
Northern Illinois University
Voice: 815-753-1678
Fax: 815-753-2555
jasrich () niu edu

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.