Re: Mirror Masters

2013-04-23 Thread Chris Buxton 

On Apr 23, 2013, at 2:01 PM, Manson, John wrote:

> We have a second master at a different location and I was wondering if there 
> is any way to have the first master send db file updates to it using file 
> transfers like it does to the slaves.
> We currently do db file transfers between masters with sftp and would like to 
> stop using OS processes and have it done within named, if possible.
> The second master is exactly like the first master including front-side IP, 
> dns traffic router-separated from the first master, and the script we use for 
> DB maintenance in a fail-over scenario.
> Both masters file transfer IPs are different and are listed in all slaves so 
> they get notifies from both.
> I’m guessing it has to do with being master for a zone and not acting on 
> notifies it may receive.

Make it a slave, using text format instead of raw format. Then in the event of 
a disaster, change all the zone statements from slave to master. That way, you 
won't be dependent on OS processes for transferring and synchronizing the data 
between the two masters.

Your other choice is to use rsync to synchronize files between the two masters, 
perhaps as a cron job.

Chris Buxton

___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Mirror Masters

2013-04-23 Thread Manson, John 
We have a second master at a different location and I was wondering if there is 
any way to have the first master send db file updates to it using file 
transfers like it does to the slaves.
We currently do db file transfers between masters with sftp and would like to 
stop using OS processes and have it done within named, if possible.
The second master is exactly like the first master including front-side IP, dns 
traffic router-separated from the first master, and the script we use for DB 
maintenance in a fail-over scenario.
Both masters file transfer IPs are different and are listed in all slaves so 
they get notifies from both.
I'm guessing it has to do with being master for a zone and not acting on 
notifies it may receive.

Thanks

John Manson
CAO/HIR/NAF Data-Communications | U.S. House of Representatives | Washington, 
DC 20515
Desk: 202-226-4244 | TCC: 202-226-6430 | 
john.man...@mail.house.gov

___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: BIND 9.5.0 DoS?

2013-04-23 Thread Kevin Darcy 
Of course it's readable; your packet decoder isn't particularly smart, 
however. You might want to consider saving off the capture and viewing 
it in something like Wireshark.


In any case, you're returning 4 RRSIG records (that's what type 46 is), 
all 13 root NSes in the Authority Section, and an OPT in the Additional 
Section. Looks relatively normal to me. You sure this client 
(72.45.3.47) isn't simply misconfigured to use your nameserver? Maybe 
they mistyped an IP address in /etc/resolv.conf (?) (Before asking that 
question, I probably should have decoded the packet enough to see if the 
RD bit was set. But I'm too mentally lazy today :-)


I'll note that if this client really wanted to DoS you, with a 4K EDNS0 
buffer size, they could have done *much*worse*.


- Kevin

On 4/23/2013 9:12 AM, Grant Peel wrote:


Hi all,

We have noticed a huge spike in transfer last week, that calmed down 
to a transfer rate of about 191 kb/s since. The original outgoing 
spike (1.5 mb/s) lasted about 1 day, but, as mentioned has subsided.


I have never seen this before and are wondering if this is some kind 
of DoS or other attack.


I have looked several times using data capture, but the data does not 
appear to be readable.


The UDP data packets are coming through port 53.

Here is a snip of the captured data below. Any hints or suggestions 
will be appreciated.


22:27:56.607435 IP (tos 0x0, ttl  64, id 17307, offset 0, flags 
[none], proto: UDP (17), length


: 1027, bad cksum 0 (->1480)!) ns1.mynameserver.com.domain > 
72-45-3-047-dhcp.gsv.md.atlanticbb.ne


t.46886: [bad udp cksum 1087!]  47670*- q: Type46? . 4/13/1 . Type46, 
. Type46, . Type46, . Typ


e46 ns: . NS f.root-servers.net., . NS d.root-servers.net., . NS 
m.root-servers.net., . NS h.ro


ot-servers.net., . NS i.root-servers.net., . NS e.root-servers.net., . 
NS a.root-servers.net.,


. NS j.root-servers.net., . NS c.root-servers.net., . NS 
b.root-servers.net., . NS k.root-serve


rs.net., . NS l.root-servers.net., . NS g.root-servers.net. ar: . OPT 
UDPsize=4096 (999)


0x:  4500 0403 439b  4011  cf70 0403  E...C...@p..

0x0010:  482d 032f 0035 b726 03ef 22d0 ba36 8500  H-./.5.&.."..6..

0x0020:  0001 0004 000d 0001  2e00 0100 002e  

0x0030:  0001 0001 5180 0093 0006 0800 0001 5180  Q.Q.

0x0040:  517c 6680 5173 1df0 5064 008c e342 a7e2  Q|f.Qs..Pd...B..

0x0050:  df8b e619 dd4e a90d 8e45 fb3f ae67 863c  .N...E.?.g.<

0x0060:  228a 1ef7 e736 533e 2868 6ed2 90ff cd3b  "6S>(hn;

0x0070:  cf6c b32c e634 3709 296d a86d c14a ee17  .l.,.47.)m.m.J..

0x0080:  8b65 7046 6f3f a0f1 1654 486c d8ac d036  .epFo?...THl...6

0x0090:  03a7 ce4e a039 4c9d 3530 2d79 017e 0ecd  ...N.9L.50-y.~..

0x00a0:  f92c c576 8560 8570 b396 d053 407b ee6e  .,.v.`.p...S@{.n

0x00b0:  b4c5 a40e 7326 b281 721d 3910 dd69 d546  s&..r.9..i.F

0x00c0:  97d0 5fb1 ac0e 4315 5604 b900 002e 0001  .._...C.V...

0x00d0:  0007 e900 0093 0002 0800 0007 e900 517c  ..Q|

0x00e0:  6680 5173 1df0 5064 002d acf6 e189 72bf  f.Qs..Pd.-r.

0x00f0:  183d efc2 1bf5 ecf1 3e52 3c1f a2e7 cd03  .=..>R<.

0x0100:  efb2 2d03 2223 2743 560e 4f68 7c6b db5b  ..-."#'CV.Oh|k.[

0x0110:  053b 9940 29a9 19e3 b108 2ae7 188e 84ee  .;.@).*.

0x0120:  a926 c7a0 02f4 8344 f2a3 8fe0 d7b9 ffeb  .&.D

0x0130:  39ee 54b3 f5a2 f1e6 7578 a893 126c 8d85  9.T.ux...l..

0x0140:  b6c8 1086 b441 5fe9 59c3 cbd1 a885 0afa  .A_.Y...

0x0150:  cb12 bbfe 8367 82c8 2b27 ed68 c394 72f6  .g..+'.h..r.

0x0160:  3ac0 c193 e196 5b10 1100 002e 0001 0002  :.[.

0x0170:  a300 0113 0030 0800 0002 a300 5186 f27f  .0..Q...

0x0180:  5173 2c00 4a5c 0023 596e 6b3c 0582 bf8f  Qs,.J\.#Ynk<

0x0190:  3c6b b7e6 a103 67ca 4057 9e22 90e0 fa5d  ..+7..l

0x0230:  f32a 956b 31fd 9e25 1470 b792 ba6f 0c09  .*.k1..%.p...o..

0x0240:  547c 28c0 4d19 5f96 3686 ffc8 ebce f29b  T|(.M._.6...

0x0250:  8ab2 31cc 2fbe 62a7 e38e ca0d 3214 4984  ..1./.b.2.I.

0x0260:  86c6 bddb 335a 9047 cf30 cb06 67b6 970c  3Z.G.0..g...

0x0270:  9c9f 37b1 be32 7394 af17 865b e9b2 5e02  ..7..2s[..^.

0x0280:  18ec 58e0 77e0 0100 002e 0001 0001 5180  ..X.w.Q.

0x0290:  0093 002f 0800 0001 5180 517c 6680 5173  .../Q.Q|f.Qs

0x02a0:  1df0 5064 006c b2c0 9e7f 9d29 87d4 d8c7  ..Pd.l.)

0x02b0:  90f8 4e77 a3aa 9fba c3e6 acdf 6523 c6f7  ..Nwe#..

0x02c0:  4312 e4e7 5b05 68ef ebcc edbb b1cd 70a9  C...[.h...p.

0x02d0:  f7ee 86a6 93d0 ef25 9703 83e2 6e5a 9ff9  ...%nZ..

0x02e0:  0fd5 38ed 2d98 0f50 987b 3ff8 d8a8 7f9f  ..8.-..P.{?.

0x02f0:  0b8c c88e 6d03 4718 7b03 2f0

BIND 9.5.0 DoS?

2013-04-23 Thread Grant Peel 
Hi all,

 

We have noticed a huge spike in transfer last week, that calmed down to a
transfer rate of about 191 kb/s since. The original outgoing spike (1.5
mb/s) lasted about 1 day, but, as mentioned has subsided.

I have never seen this before and are wondering if this is some kind of DoS
or other attack.

I have looked several times using data capture, but the data does not appear
to be readable.

The UDP data packets are coming through port 53. 

Here is a snip of the captured data below. Any hints or suggestions will be
appreciated.

 

22:27:56.607435 IP (tos 0x0, ttl  64, id 17307, offset 0, flags [none],
proto: UDP (17), length

: 1027, bad cksum 0 (->1480)!) ns1.mynameserver.com.domain >
72-45-3-047-dhcp.gsv.md.atlanticbb.ne

t.46886: [bad udp cksum 1087!]  47670*- q: Type46? . 4/13/1 . Type46, .
Type46, . Type46, . Typ

e46 ns: . NS f.root-servers.net., . NS d.root-servers.net., . NS
m.root-servers.net., . NS h.ro

ot-servers.net., . NS i.root-servers.net., . NS e.root-servers.net., . NS
a.root-servers.net.,

. NS j.root-servers.net., . NS c.root-servers.net., . NS
b.root-servers.net., . NS k.root-serve

rs.net., . NS l.root-servers.net., . NS g.root-servers.net. ar: . OPT
UDPsize=4096 (999)

0x:  4500 0403 439b  4011  cf70 0403  E...C...@p..

0x0010:  482d 032f 0035 b726 03ef 22d0 ba36 8500  H-./.5.&.."..6..

0x0020:  0001 0004 000d 0001  2e00 0100 002e  

0x0030:  0001 0001 5180 0093 0006 0800 0001 5180  Q.Q.

0x0040:  517c 6680 5173 1df0 5064 008c e342 a7e2  Q|f.Qs..Pd...B..

0x0050:  df8b e619 dd4e a90d 8e45 fb3f ae67 863c  .N...E.?.g.<

0x0060:  228a 1ef7 e736 533e 2868 6ed2 90ff cd3b  "6S>(hn;

0x0070:  cf6c b32c e634 3709 296d a86d c14a ee17  .l.,.47.)m.m.J..

0x0080:  8b65 7046 6f3f a0f1 1654 486c d8ac d036  .epFo?...THl...6

0x0090:  03a7 ce4e a039 4c9d 3530 2d79 017e 0ecd  ...N.9L.50-y.~..

0x00a0:  f92c c576 8560 8570 b396 d053 407b ee6e  .,.v.`.p...S@{.n

0x00b0:  b4c5 a40e 7326 b281 721d 3910 dd69 d546  s&..r.9..i.F

0x00c0:  97d0 5fb1 ac0e 4315 5604 b900 002e 0001  .._...C.V...

0x00d0:  0007 e900 0093 0002 0800 0007 e900 517c  ..Q|

0x00e0:  6680 5173 1df0 5064 002d acf6 e189 72bf  f.Qs..Pd.-r.

0x00f0:  183d efc2 1bf5 ecf1 3e52 3c1f a2e7 cd03  .=..>R<.

0x0100:  efb2 2d03 2223 2743 560e 4f68 7c6b db5b  ..-."#'CV.Oh|k.[

0x0110:  053b 9940 29a9 19e3 b108 2ae7 188e 84ee  .;.@).*.

0x0120:  a926 c7a0 02f4 8344 f2a3 8fe0 d7b9 ffeb  .&.D

0x0130:  39ee 54b3 f5a2 f1e6 7578 a893 126c 8d85  9.T.ux...l..

0x0140:  b6c8 1086 b441 5fe9 59c3 cbd1 a885 0afa  .A_.Y...

0x0150:  cb12 bbfe 8367 82c8 2b27 ed68 c394 72f6  .g..+'.h..r.

0x0160:  3ac0 c193 e196 5b10 1100 002e 0001 0002  :.[.

0x0170:  a300 0113 0030 0800 0002 a300 5186 f27f  .0..Q...

0x0180:  5173 2c00 4a5c 0023 596e 6b3c 0582 bf8f  Qs,.J\.#Ynk<

0x0190:  3c6b b7e6 a103 67ca 4057 9e22 90e0 fa5d  ..+7..l

0x0230:  f32a 956b 31fd 9e25 1470 b792 ba6f 0c09  .*.k1..%.p...o..

0x0240:  547c 28c0 4d19 5f96 3686 ffc8 ebce f29b  T|(.M._.6...

0x0250:  8ab2 31cc 2fbe 62a7 e38e ca0d 3214 4984  ..1./.b.2.I.

0x0260:  86c6 bddb 335a 9047 cf30 cb06 67b6 970c  3Z.G.0..g...

0x0270:  9c9f 37b1 be32 7394 af17 865b e9b2 5e02  ..7..2s[..^.

0x0280:  18ec 58e0 77e0 0100 002e 0001 0001 5180  ..X.w.Q.

0x0290:  0093 002f 0800 0001 5180 517c 6680 5173  .../Q.Q|f.Qs

0x02a0:  1df0 5064 006c b2c0 9e7f 9d29 87d4 d8c7  ..Pd.l.)

0x02b0:  90f8 4e77 a3aa 9fba c3e6 acdf 6523 c6f7  ..Nwe#..

0x02c0:  4312 e4e7 5b05 68ef ebcc edbb b1cd 70a9  C...[.h...p.

0x02d0:  f7ee 86a6 93d0 ef25 9703 83e2 6e5a 9ff9  ...%nZ..

0x02e0:  0fd5 38ed 2d98 0f50 987b 3ff8 d8a8 7f9f  ..8.-..P.{?.

0x02f0:  0b8c c88e 6d03 4718 7b03 2f07 d0fa d8bb  m.G.{./.

0x0300:  4ce1 91c0 b401 f405 4e93 7c8b c7f6 0dab  L...N.|.

0x0310:  2814 81c9 b231 efac c0f1 1ef4 48b5 f796  (1..H...

0x0320:  357f 40a5 8400 0002 0001 0007 e900 0014  5.@.

0x0330:  0166 0c72 6f6f 742d 7365 7276 6572 7303  .f.root-servers.

0x0340:  6e65 7400  0200 0100 07e9  0401  net.

0x0350:  64c3 1600 0002 0001 0007 e900 0004 016d  d..m

0x0360:  c316  0200 0100 07e9  0401 68c3  ..h.

0x0370:  1600 0002 0001 0007 e900 0004 0169 c316  .i..

0x0380:   0200 0100 07e9  0401 65c3 1600  e...

0x0390:  0002 0001 0007 e900 0004 0161 c316   ...a

0x03a0:  0200 0100 07e9  0401 6ac3 1600 0002  ...