[104930] in North American Network Operators' Group
Re: Large number of DNS probes in last 24 hours
daemon@ATHENA.MIT.EDU (John Menerick)
Fri May 30 14:55:28 2008
From: John Menerick <onewingaengel@gmail.com>
To: Lynda <shrdlu@deaddrop.org>
In-Reply-To: <4840354F.8090206@deaddrop.org>
Date: Fri, 30 May 2008 11:54:56 -0700
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
I have seen this as well on my fringe IP-space networks. Just a
botnet or two running along the range. A cost of doing business :\
John Menerick
http://icehax.us
On May 30, 2008, at 10:11 AM, Lynda wrote:
> Jim Wise wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> I've seen a surprising number of attempted recursive DNS requests
>> against unpublished non-recursive DNS servers in the last 24 hours
>> or so, many of them obviously probes of some sort (query for "." IN
>> NS, eg).
>
>> Is anyone else seeing this? Is it new? Or did some botnet just
>> reach this corner of the IP space?
>
> Yes, no, and yes. I've seen this sort of thing severe enough that I
> simply took the servers down for a day (yes, really), even
> considering the severe inconvenience that caused.
>
> --
> Die Gedanken sind frei
>
>
