On Nov 27, 2005, at 3:30 PM, Piotr Kamisiski wrote:
Recently my DNS servers get jammed with bogus queries. The attacks
come in series, taking a few minutes each, sometimes from different
IPs at the same time, at least twice a day.
<snap>
23:05:40.241026 IP 204.92.73.10.40760 > xx.xx.xx.xx.53: 38545+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:41.600902 IP 204.92.73.10.16561 > xx.xx.xx.xx.53: 22242+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:42.091743 IP 204.92.73.10.37547 > xx.xx.xx.xx.53: 64644+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:43.433539 IP 204.92.73.10.32370 > xx.xx.xx.xx.53: 31772+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:43.854481 IP 204.92.73.10.12913 > xx.xx.xx.xx.53: 33470+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:44.378640 IP 204.92.73.10.62484 > xx.xx.xx.xx.53: 8726+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:45.368970 IP 204.92.73.10.57384 > xx.xx.xx.xx.53: 1073+
[1au] ANY ANY? e.mpisi.com. (40)
23:05:45.379251 IP 204.92.73.10.36997 > xx.xx.xx.xx.53: 22257+
[1au] ANY ANY? e.mpisi.com. (40)
<snap>
Has anyone noticed a similar activity?
I was seeing this kind of thing last month. I suspect that it's part
of a DDoS attack on the IP address that the queries claim to come
from, but it could also be an attack on your DNS server. The idea is
that the attacker sends a small bogus DNS query on UDP port 53 with a
bogus IP address. Your server then sends a much larger response to
that IP address, greatly multiplying the amount of traffic that the
attacker can direct at the target site. This occurs via UDP since
that makes it easy to spoof the source address.
Assuming you use Bind, can edit your named.conf file, only wish to
provide recursive DNS services (ie. handle queries for domains that
you are not authoritative for) to a known range of IP addresses, and
the query is for a domain that you're not authoritative for, you can
solve the problem by adding something like this to named.conf:
options {
allow-recursion { 127.0.0.1/32; };
};
That particular setting would cause Bind to ignore recursive queries
from all IP addresses except 127.0.0.1 (localhost). My DNS server
only provides recursive queries for itself, so the setting was easy
for me. After I started blocking recursive queries, it took a week
or so for the bogus traffic to stop. But in the mean time, since I
wasn't sending responses, the amount of my bandwidth that was wasted
decreased dramatically.
