DNS DoS ???

Fri Jul 29 18:51:05 UTC 2011

my DNS servers were getting slow so I blocked recursive queries for
all but my own network.

Then I was getting so many of these:

ns2 named[5056]: client 78.159.111.190#25345: query (cache)
'isc.org/ANY/IN' denied

that is was still slowing things down.  I've since written a script to
watch the log and throw these into the box local firewall.  If I
expire the entries after 24 hours then I accumulate about 10200 unique
IPs.  If I expire after 48 hours, then it's just over 20000 unique
IPs.

Is anyone else seeing this?

Elliot