We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the web it looks like it could be part of an amplified DNS attack. Its windows 2008, and stupidly I hadn't disabled recursion (I had done on the primary). Recursion has now been disabled for 48 hours, but the requests keep on comming (however, the impact on our bandwidth useage is less).
I contacted BT Business who said as the source isn't on their network it's not their problem. I have contacted the providers of the addresses of the source traffic, but they have all responded saying that the IP's have been spoofed.
I'm currently just trying to keep the firewall up to date and block them manually, however, it's not a long term solution.
Any advice on what to do next would be appreciated.