On Monday 28 November 2005 01:30, Piotr Kamisiski wrote:
> Recently my DNS servers get jammed with bogus queries. The attacks come in
> series, taking a few minutes each, sometimes from different IPs at the
> same time, at least twice a day.
My DNS servers were attacked the similar way in the beginning of this year.
All queries were originated from a lot of sources. Senders of these packets
were not bogus obviously, because after firewalling incoming requests from
any of them, the rate of flooding became lower. All requests were made to one
of my domains.
Daily DNS traffic was about 400-500 Mb.
To automate the firewalling process I wrote a program, that sniffed DNS
traffic and automatically added to firewall DROP rules.
--
Best regards. Alexander Lourier. http://aml.rulezz.ru
> Recently my DNS servers get jammed with bogus queries. The attacks come in
> series, taking a few minutes each, sometimes from different IPs at the
> same time, at least twice a day.
My DNS servers were attacked the similar way in the beginning of this year.
All queries were originated from a lot of sources. Senders of these packets
were not bogus obviously, because after firewalling incoming requests from
any of them, the rate of flooding became lower. All requests were made to one
of my domains.
Daily DNS traffic was about 400-500 Mb.
To automate the firewalling process I wrote a program, that sniffed DNS
traffic and automatically added to firewall DROP rules.
--
Best regards. Alexander Lourier. http://aml.rulezz.ru
[ reply ]