[28336] in North American Network Operators' Group
Re: dns hits / 212.5.128/19 going wild
daemon@ATHENA.MIT.EDU (Kevin Houle)
Wed Apr 26 12:45:38 2000
Message-ID: <39071C9D.99C409F@cert.org>
Date: Wed, 26 Apr 2000 12:43:09 -0400
From: Kevin Houle <kjh@cert.org>
MIME-Version: 1.0
To: JP Donnio <ml-nanog@TBS-internet.com>
Cc: nanog@merit.edu
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Errors-To: owner-nanog-outgoing@merit.edu
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
JP Donnio wrote:
>
> I am seeing a somewhat similar problem with my name server. It is configured
> not to recurse queries except for our network. Since I enabled this feature,
> I noticed we receive numerous requests from unauthorized hosts. It seems all
> the unauthorized queries are MX requests for AOL.COM. Here's a sample
> rejection log:
>
> 25-Apr-2000 12:21:48.647 security: unapproved recursive query from
> [212.5.135.39].2091 for aol.com
...
> Now I do not understand why we are getting those hits. Our nameserver
> (207.153.200.35) is not an aol.com secondary and has never been.
>
> Does anyone have a clue?
We have had several reports of similar activity this year, and a
recent increase in reports. The leading theory is that this is a
signature of a denial of service attack. The general idea is that
a DNS query is sent via UDP to an intermediate nameserver using a
spoofed source address. The nameserver's reply is directed to the
spoofed address, which in the DoS attack, is the victim.
The size of the response can be greater than the size of the
request, which causes packet amplification. The degree of
amplification depends on the size of the query, the recursive
nature of the nameserver, and the size of the answer. Where
recursion is turned off, there is still a 'rejected' message
sent, and the reject is typically logged. We've seen this
technique used in a distributed fashion, with multiple nameservers
receiving queries from similar forged source addresses.
The DoS method described here is a known issue. AusCERT published
an advisory in August 1999 that may be of interest.
ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos
Regards,
Kevin
- --
Kevin Houle
CERT Coordination Center
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv
iQA/AwUBOQcaJrvzUwvl02xJEQJOPACgzzVNJDlT85zE6NJNsrMGkZtMYA4AoPBR
hOcKUp9NytcyNp8fS5FnCoPZ
=t0JQ
-----END PGP SIGNATURE-----
