DNS dDos Attack!

Fri Mar 28 14:39:02 UTC 2003

Personally I'd blackhole the traffic at the entry point and work on finding the 
origin.

Assuming its only one of your name servers you can run with one dead...

On Fri, 28 Mar 2003, Dan Armstrong wrote:

> 
> I am sorry if this has come up before, but it seems that one of our name
> 
> servers is under some sort of dDos attack.  It seems to be receiving
> millions of queries form spoofed IPs, and it is spending all of it's
> time sending back icmp unreachables.
> 
> It is running bind 4.31 under BSD 4.62STABLE
> 
> Help!
> 
> Thanks,
> Dan.
> 
> 