Re: DNS DoS ???

[Thomas York <straterra () fuhell com>]

I see this all the time on my personal servers. I finally just told bind 
to stop logging it.

On 07/29/2011 02:51 PM, Elliot Finley wrote:
> my DNS servers were getting slow so I blocked recursive queries for
> all but my own network.
>
> Then I was getting so many of these:
>
> ns2 named[5056]: client 78.159.111.190#25345: query (cache)
> 'isc.org/ANY/IN' denied
>
> that is was still slowing things down.  I've since written a script to
> watch the log and throw these into the box local firewall.  If I
> expire the entries after 24 hours then I accumulate about 10200 unique
> IPs.  If I expire after 48 hours, then it's just over 20000 unique
> IPs.
>
> Is anyone else seeing this?
>
> Elliot

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature