Re: Large DNS scans from 211.53.208.178

[kaos () OCS COM AU (Keith Owens)]

On Wed, 3 May 2000 19:28:01 -0400,
Igor Gashinsky <pain () ROYAL NET> wrote:
> It may be worth a try to log traffic to your DNS server, and see if
> everything is over UDP, and if it is, lock up 53/TCP. It would greatly
> improve the security of that machine.

Better still, allow all outgoing 53/TCP but only allow incoming 53/TCP
when the ACK bit is set, i.e. if the packet is for an existing session.
That way you can still use DNS over TCP to query servers which return
large packets (you start the session) but nobody can access your DNS
over TCP (they cannot start a session).

This assumes that none of your DNS responses are large enough to
require TCP.  Don't forget to allow your external secondary name
servers to access DNS over TCP, they need it for zone transfers.