nanog mailing list archives

Re: random dns queries with random sources


From: Joe Maimon <jmaimon () ttec com>
Date: Wed, 19 Feb 2014 00:48:20 -0500



George Herbert wrote:
Right.  Nonzero chances that you (Joe's site) are the target...

Also, check if you have egress filtering of spoofed addresses below these
DNS resources, between them and any user objects.  You could be sourcing
the spoofing if not...

It seems to me that the same|similar dataset of open resolvers to be used for amplification attacks is also being used for this sort of thing, and the overall effect is not large enough to indicate my resources are a target.

What I cant figure out is what is the target and how this attack method is any more effective then the others.

Joe


Current thread: