Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently I run a DNS server (bind9) that handles queries from clients over the internet lately I have noticed hundreds of queries from all different address's that look like this (Server IP removed)

client 216.59.33.210#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 216.59.33.204#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 184.107.255.202#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 205.204.65.83#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 69.162.110.106#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 216.59.33.210#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 69.162.110.106#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 216.59.33.204#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)

Can someone please explain why there are so many clients querying for ripe.net ?

share|improve this question
    
I wrote a little bash script to automatic block the abusing ip addresses by checking the query.log Block ripe.net requests –  Christopher Wilson Jun 20 '12 at 6:15

2 Answers 2

up vote 8 down vote accepted
+50

When a DNS-server is configured openly like this it is abused by others in DNS amplifications attacks. The attacker forges the IP-addresses of the DDOS targets and send out a lot of small queries (often of type ANY) to servers like yours.

ripe.net ANY is used because it returns a large answer and therefore amplifies the size of the attackers spoofed query towards the target.

share|improve this answer
    
Thanks I have never heard of DNS amplifications attacks.. I will have a read now. –  Christopher Wilson Jun 11 '12 at 23:28
    

Looks like what you want is to disable recursion or allow recursion to specific IP addresses (e.g. local host):

http://www.zytrax.com/books/dns/ch7/queries.html#allow-recursion

The default is to allow anyone.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.