bugtraq - Re: DNS query spam

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 29 Nov 2005 09:52:17 +0300
From: Alexander Lourier <aml@...ezz.ru>
To: bugtraq@...urityfocus.com
Subject: Re: DNS query spam

On Monday 28 November 2005 01:30, Piotr Kamisiski wrote:

> Recently my DNS servers get jammed with bogus queries. The attacks come in
> series, taking a few minutes each, sometimes from different IPs at the
> same time, at least twice a day.

My DNS servers were attacked the similar way in the beginning of this year. 
All queries were originated from a lot of sources. Senders of these packets 
were not bogus obviously, because after firewalling incoming requests from 
any of them, the rate of flooding became lower. All requests were made to one 
of my domains.

Daily DNS traffic was about 400-500 Mb.

To automate the firewalling process I wrote a program, that sniffed DNS 
traffic and automatically added to firewall DROP rules.

-- 
Best regards. Alexander Lourier. http://aml.rulezz.ru

Content of type "application/pgp-signature" skipped