[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Attack on the DNS ?

Subject: Attack on the DNS ?
From: lowen at pari.edu (Lamar Owen)
Date: Sat, 31 Mar 2012 18:03:15 -0400
In-reply-to: <[email protected]>
References: <CAJNg7V+6JWwhvVfbrpXvx_Ex-o1vHfSpmHksBA+2mUrPFELvJA@mail.gmail.com>

On Saturday, March 31, 2012 04:28:17 PM sthaug at nethelp.no wrote:
> ANY queries for isc.org and ripe.net are popular (ietf.org has also been
> seen), since they give a potentially large amplification factor.

FWIW, saw ANY queries at a rate of 10 per second from one IP to a DNS server today, all for isc.org.  Saw a few hundred more for tmss.trendmicro.com from a different IP. Other popular names include plus.google.com, maps.google.com, and play.google.com. (all denied by that particular server, which is patched against such).

Anyone know if there's a project to track popular amplification names?  :-)

References:
- Attack on the DNS ?
  - From: marshall.eubanks at gmail.com (Marshall Eubanks)
- Attack on the DNS ?
  - From: sthaug at nethelp.no (sthaug at nethelp.no)

Prev by Date: uunet ends newsfeed/newsreader in US
Next by Date: Outdoor Wireless Access Point
Previous by thread: Attack on the DNS ?
Next by thread: Attack on the DNS ?
Index(es):
- Date
- Thread