0

I have some problems with my two AD/DNS servers for my hosted Exchange setup, as they suddently began to consume large amounts of bandwidth (~10mbit each), which I think is really strange, as they are not really in use yet.

Heres are some screens from TCPView on the servers:

Server 1 Server 2

As you can see, the DNS process really consumes some bandwidth.

I checked the firewall logs, and it doesn't seem like someone from the outside is trying to make a lot of DNS requests.

How do I troubleshoot from here? Shutting down the DNS service brings the bandwidth usage down, but that is not an optimal solution.

EDIT

Running wireshark on the two servers gives me a load of DNS queries for ripe.net: type ANY, class IN

I have uploaded two capture files from my servers, each ran for ~20secs.
Server1.pcapng Server2.pcapng
(My servers IP's are 77.66.101.162/10.10.10.1 and 77.66.101.189/10.10.10.2)

4
  • I had this happen to me too. I ended up taking the DNS servers and made them inaccessable from the outside. If you google "dns flood ripe.net" you'll see plenty of "wth? where are all these requests coming from". My suggetion is to limit your exposed area and block the offending IPs if possible.
    – MikeAWood
    Aug 7, 2012 at 14:25
  • Problem is just that it is sure a hell lot of different IP's making those requests, and reading on the net, it seems like those are spoofed too. Seems like I might just have to live with it, as blocking access from the outside world is not really a solution, as they are authorative servers for the domain.
    – Frederik
    Aug 7, 2012 at 14:31
  • Ours were too, I let our registrar take it over so they got nailed as opposed to ours.
    – MikeAWood
    Aug 15, 2012 at 0:16
  • You should block them from outside, pleaase read this link : translate.google.fr/…
    – Avlin
    Dec 24, 2015 at 3:03

1 Answer 1

0

Your first step should be determining if you actually have a problem.

I don't see anything there which makes me think you do. 10 million bits is a lot... if you're sending that many a second. Of course, if you have a large network, that might be expected behavior. Also, with most everything these days being a 100 meg or 1 gig link, 10 mbit is at most, 10% of your bandwidth. Is it actually causing you a problem, or are you looking too hard and creating one where nothing's wrong?

If you end up deciding you do have a problem, the first thing you should do is run a packet capture program on the DNS server to track down where all the requests are coming from. There are a lot of possibe reasons you could be seeing abnormally high DNS traffic - anything from an infected client PC trying to contact a C&C server, to a DNS misconfiguration that's bouncing name lookups around in your network in a loop.

2
  • The servers are running virtualized in a vmware environment, and have 10gig virtual nics, connected to 4 physical 1gig nics. We have a 100mbit WAN connection, so consuming 20mbit (2x10) of it just with these two servers seems like a lot to me. I will try to run some packet capturing and see what it is.
    – Frederik
    Aug 6, 2012 at 14:11
  • Please see my edit, as it contains new info and capture files.
    – Frederik
    Aug 6, 2012 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .