Bugtraq mailing list archives

Re: DNS query spam

From: Alexander Lourier <aml () rulezz ru>
Date: Tue, 29 Nov 2005 09:52:17 +0300

On Monday 28 November 2005 01:30, Piotr Kamisiski wrote:

Recently my DNS servers get jammed with bogus queries. The attacks come in
series, taking a few minutes each, sometimes from different IPs at the
same time, at least twice a day.


My DNS servers were attacked the similar way in the beginning of this year. 
All queries were originated from a lot of sources. Senders of these packets 
were not bogus obviously, because after firewalling incoming requests from 
any of them, the rate of flooding became lower. All requests were made to one 
of my domains.

Daily DNS traffic was about 400-500 Mb.

To automate the firewalling process I wrote a program, that sniffed DNS 
traffic and automatically added to firewall DROP rules.

-- 
Best regards. Alexander Lourier. http://aml.rulezz.ru

Attachment: _bin
Description:

Current thread:

DNS query spam Piotr Kamisiski (Nov 28)
- Re: DNS query spam Josep Ma Castells (Nov 29)
  - Re: DNS query spam Florian Weimer (Nov 30)
  - Re: DNS query spam Joe (Nov 30)
- Re: DNS query spam Antone Roundy (Nov 29)
  - Re: DNS query spam Stephen Stuart (Nov 30)
- Re: DNS query spam Alexander Lourier (Nov 29)
- Re: DNS query spam Florian Weimer (Nov 29)
  - Re: DNS query spam Piotr Kamisiski (Nov 29)
  - Re: DNS query spam Jim Pingle (Nov 30)