[143110] in North American Network Operators' Group
DNS DoS ???
daemon@ATHENA.MIT.EDU (Elliot Finley)
Fri Jul 29 14:52:06 2011
Date: Fri, 29 Jul 2011 12:51:05 -0600
From: Elliot Finley <efinley.lists@gmail.com>
To: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
my DNS servers were getting slow so I blocked recursive queries for
all but my own network.
Then I was getting so many of these:
ns2 named[5056]: client 78.159.111.190#25345: query (cache)
'isc.org/ANY/IN' denied
that is was still slowing things down. I've since written a script to
watch the log and throw these into the box local firewall. If I
expire the entries after 24 hours then I accumulate about 10200 unique
IPs. If I expire after 48 hours, then it's just over 20000 unique
IPs.
Is anyone else seeing this?
Elliot
