From: Michael Shigorin <mike@osdn.org.ua>
To: community@lists.altlinux.org
Subject: [Comm] Fwd: Re: DNS query spam
Date: Wed, 30 Nov 2005 12:53:48 +0200
Message-ID: <20051130105348.GD22267@osdn.org.ua> (raw)
[-- Attachment #1: Type: text/plain, Size: 2990 bytes --]
Здравствуйте.
Можно ещё раз сказать спасибо правильным умолчаниям
в нашем bind...
----- Forwarded message from Antone Roundy <antone/geckotribe.com> -----
Date: Mon, 28 Nov 2005 17:37:35 -0700
From: Antone Roundy <antone/geckotribe.com>
To: bugtraq/securityfocus.com
Subject: Re: DNS query spam
On Nov 27, 2005, at 3:30 PM, Piotr Kamisiski wrote:
>Recently my DNS servers get jammed with bogus queries. The attacks
>come in series, taking a few minutes each, sometimes from different
>IPs at the same time, at least twice a day.
>
><snap>
>23:05:40.241026 IP 204.92.73.10.40760 > xx.xx.xx.xx.53: 38545+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:41.600902 IP 204.92.73.10.16561 > xx.xx.xx.xx.53: 22242+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:42.091743 IP 204.92.73.10.37547 > xx.xx.xx.xx.53: 64644+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:43.433539 IP 204.92.73.10.32370 > xx.xx.xx.xx.53: 31772+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:43.854481 IP 204.92.73.10.12913 > xx.xx.xx.xx.53: 33470+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:44.378640 IP 204.92.73.10.62484 > xx.xx.xx.xx.53: 8726+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:45.368970 IP 204.92.73.10.57384 > xx.xx.xx.xx.53: 1073+
>[1au] ANY ANY? e.mpisi.com. (40)
>23:05:45.379251 IP 204.92.73.10.36997 > xx.xx.xx.xx.53: 22257+
>[1au] ANY ANY? e.mpisi.com. (40)
><snap>
>
>Has anyone noticed a similar activity?
I was seeing this kind of thing last month. I suspect that it's part
of a DDoS attack on the IP address that the queries claim to come
from, but it could also be an attack on your DNS server. The idea is
that the attacker sends a small bogus DNS query on UDP port 53 with a
bogus IP address. Your server then sends a much larger response to
that IP address, greatly multiplying the amount of traffic that the
attacker can direct at the target site. This occurs via UDP since
that makes it easy to spoof the source address.
Assuming you use Bind, can edit your named.conf file, only wish to
provide recursive DNS services (ie. handle queries for domains that
you are not authoritative for) to a known range of IP addresses, and
the query is for a domain that you're not authoritative for, you can
solve the problem by adding something like this to named.conf:
options {
allow-recursion { 127.0.0.1/32; };
};
That particular setting would cause Bind to ignore recursive queries
from all IP addresses except 127.0.0.1 (localhost). My DNS server
only provides recursive queries for itself, so the setting was easy
for me. After I started blocking recursive queries, it took a week
or so for the bogus traffic to stop. But in the mean time, since I
wasn't sending responses, the amount of my bandwidth that was wasted
decreased dramatically.
----- End forwarded message -----
--
---- WBR, Michael Shigorin <mike@altlinux.ru>
------ Linux.Kiev http://www.linux.kiev.ua/
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
reply other threads:[~2005-11-30 10:53 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20051130105348.GD22267@osdn.org.ua \
--to=mike@osdn.org.ua \
--cc=community@lists.altlinux.org \
--cc=shigorin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
ALT Linux Community general discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 community community/ http://lore.altlinux.org/community \
mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com
public-inbox-index community
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.community
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git