On Monday 28 November 2005 01:30, Piotr Kamisiski wrote: > Recently my DNS servers get jammed with bogus queries. The attacks come in > series, taking a few minutes each, sometimes from different IPs at the > same time, at least twice a day. My DNS servers were attacked the similar way in the beginning of this year. All queries were originated from a lot of sources. Senders of these packets were not bogus obviously, because after firewalling incoming requests from any of them, the rate of flooding became lower. All requests were made to one of my domains. Daily DNS traffic was about 400-500 Mb. To automate the firewalling process I wrote a program, that sniffed DNS traffic and automatically added to firewall DROP rules. -- Best regards. Alexander Lourier. http://aml.rulezz.ru
Attachment:
pgpQhxWpD6Qve.pgp
Description: PGP signature