The latest attacks: loads and loads of q ... / 2009-01-20

2009-01-20 The latest attacks: loads and loads of q ...
The latest attacks: loads and loads of queries for the root nameservers, which gives amplification in resolvers with not completely perfect configurations (a complete list of root nameservers) and the same amount of traffic for resolvers which are completely closed to resolving for the outside world. These are probably an attempt to flood an IP using faked queries. Samples:
Jan 19 06:41:04 greenblatt named[6377]: client 69.50.142.110#53930: query (cache) './NS/IN' denied
Jan 19 06:41:13 greenblatt named[6377]: client 69.50.142.110#15557: query (cache) './NS/IN' denied
Jan 20 16:31:47 greenblatt named[6377]: client 66.230.160.1#32412: query (cache) './NS/IN' denied
Jan 20 16:31:59 greenblatt named[6377]: client 66.230.160.1#8478: query (cache) './NS/IN' denied
Already noted at sans: DNS queries for "." isc handler's dairy where the active IPs are listed. And suddenly I see in the logs:
Jan 20 08:36:13 greenblatt named[6377]: client 208.37.177.62#46265: query (cache) './NS/IN' denied
Jan 20 11:50:48 greenblatt named[6377]: client 208.37.177.62#46265: query (cache) './NS/IN' denied
I noticed that IP doing weird DNS stuff before. So 'being attacked' is the right conclusion.

Tags: ,

IPv6 check

Running test...
, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred. PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers

RSS
Meningen zijn die van mezelf, wat ik schrijf is beschermd door auteursrecht. Sommige publicaties bevatten een expliciete vermelding dat ze ongevraagd gedeeld mogen worden.
My opinions are my own, what I write is protected by copyrights. Some publications contain an explicit license statement which allows sharing without asking permission.
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated by $Id: newsitem.cgi,v 1.55 2021/11/09 13:09:49 koos Exp $ in 0.006152 seconds.