Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Incidents
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

constant flow of root queries

from [Brian Collins] Network Security [Permanent Link]
Subject: constant flow of root queries
Date: Wed, 18 Jan 2006 09:37:03 -0500 
Good day folks.  This morning an admin asked us to check on a large amount
of traffic targeting several DNS servers in our network (both our own DNS
servers and customer co-located DNS servers).  In looking at the traffic I
see that the source is making several queries a second for DNS root.  I have
included a small sample from tcpdump below.  Not sure what the motive is
here.  The TTLs are all 235.  The random source ports makes me think
possibly spoofed traffic.  I can put packet dumps up on a website in libpcap
format if anyone is interested.  They are still going on as I type this.

Thanks for any insight you can lend.


08:44:31.681706 IP 207.210.68.202.18257 > 216.130.152.71.53:  7127+ [1au]
ANY ANY? . (28)
08:44:31.935719 IP 207.210.68.202.17460 > 216.130.152.71.53:  16133+ [1au]
ANY ANY? . (28)
08:44:32.191226 IP 207.210.68.202.11958 > 216.130.152.71.53:  24095+ [1au]
ANY ANY? . (28)
08:44:32.453721 IP 207.210.68.202.30962 > 216.130.152.71.53:  28728+ [1au]
ANY ANY? . (28)
08:44:32.965355 IP 207.210.68.202.30683 > 216.130.152.71.53:  12271+ [1au]
ANY ANY? . (28)
08:44:33.468862 IP 207.210.68.202.9966 > 216.130.152.71.53:  28170+ [1au]
ANY ANY? . (28)
08:44:33.720408 IP 207.210.68.202.9920 > 216.130.152.71.53:  28160+ [1au]
ANY ANY? . (28)
08:44:33.976693 IP 207.210.68.202.22511 > 216.130.152.71.53:  9346+ [1au]
ANY ANY? . (28)
08:44:34.233664 IP 207.210.68.202.20625 > 216.130.152.71.53:  18580+ [1au]
ANY ANY? . (28)
08:44:34.495015 IP 207.210.68.202.7023 > 216.130.152.71.53:  7968+ [1au] ANY
ANY? . (28)
08:44:34.742492 IP 207.210.68.202.6257 > 216.130.152.71.53:  11859+ [1au]
ANY ANY? . (28)
08:44:35.001415 IP 207.210.68.202.25244 > 216.130.152.71.53:  5372+ [1au]
ANY ANY? . (28)
08:44:35.257812 IP 207.210.68.202.17576 > 216.130.152.71.53:  14270+ [1au]
ANY ANY? . (28)
08:44:35.778259 IP 207.210.68.202.3384 > 216.130.152.71.53:  1508+ [1au] ANY
ANY? . (28)
08:44:36.034492 IP 207.210.68.202.13754 > 216.130.152.71.53:  23670+ [1au]
ANY ANY? . (28)
08:44:36.290463 IP 207.210.68.202.11008 > 216.130.152.71.53:  8899+ [1au]
ANY ANY? . (28)
08:44:36.805271 IP 207.210.68.202.18348 > 216.130.152.71.53:  19806+ [1au]
ANY ANY? . (28)
08:44:37.061876 IP 207.210.68.202.19532 > 216.130.152.71.53:  31844+ [1au]
ANY ANY? . (28)
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  RE: WMF Threat OK , but no huge attack ... WHY ?, Ward, Patrick James
Next by Date:  Re: constant flow of root queries, ilaiy
Previous by Thread:  Dead thread: Why was there no WMF Internet Attack..., Daniel Hanson
Next by Thread:  Re: constant flow of root queries, ilaiy
Indexes:  [Date] [Thread] [Top] [All Lists]