What's the query. Could it be related to http://www.isc.org/software/bind/advisories/cve-2011-4313?
On Thu, Jan 26, 2012 at 6:35 AM, J. von Balzac <[email protected]> wrote: > I'm seeing a lot of hosts in my named logs (I mean log files, it's not > like I am naming my poop) > > ...ok... silly joke hehe > > So anyway, named bind is reporting a lot of denied queries of type > 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which > is to immediately block the IPs for port 53 after as few as one denied > query) - but I want to warn server admins who haven't spotted both > these queries and other denied queries. > > Common sense suggests that these hosts are probably spoofed IPs. Looks > like an effective way to ddos a host: request an arbitrary DNS record > with a spoofed IP and let the server reply to the spoofed IP in > whatever way. Do that with many hosts and there is your denial of > service. > > A side effect is that when you block the IP, you're blocking something > that isn't really doing anything wrong as it's a spoofed IP > > But ok, I'm not too sure of this so please shoot holes in my theory or > suggest better fixes/workarounds/... > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
