Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

hello everyone,

i was surprised last month when my EC2 instance (ubuntu precise server), that is supposed to be under the free tier still, accumulated lots of traffic... today, while checking my current billing statement, i noticed i already have tons of traffic, while still in the middle of the month, and i'm fearing what my bill by the end of the month is going to be...

i installed bandwidthd, and after few minutes, i noticed lots of UDP traffic to "". this is apparently a cloudflare IP, and i don't have anything using cloudflare (as far as i know).

so i ran "iftop" to see what ports are being used, and i saw the UDP traffic coming from port 80 to my port 53... why would a webserver query dns?

so i stopped bind on my server, and ran it in foreground debugging mode, and saw the following query, being repeated continuously:

17-Nov-2012 12:30:58.216 client UDP request
17-Nov-2012 12:30:58.216 client request is not signed
17-Nov-2012 12:30:58.216 client recursion available
17-Nov-2012 12:30:58.216 client query
17-Nov-2012 12:30:58.216 client query (cache) '' approved
17-Nov-2012 12:30:58.216 client send
17-Nov-2012 12:30:58.216 client sendto
17-Nov-2012 12:30:58.216 client senddone
17-Nov-2012 12:30:58.217 client next
17-Nov-2012 12:30:58.217 client endrequest
17-Nov-2012 12:30:58.217 client @0x7fbee05126e0: udprecv
17-Nov-2012 12:30:58.343 client UDP request
17-Nov-2012 12:30:58.343 client request is not signed
17-Nov-2012 12:30:58.343 client recursion available
17-Nov-2012 12:30:58.343 client query
17-Nov-2012 12:30:58.343 client query (cache) '' approved
17-Nov-2012 12:30:58.343 client send
17-Nov-2012 12:30:58.344 client sendto
17-Nov-2012 12:30:58.344 client senddone
17-Nov-2012 12:30:58.344 client next
17-Nov-2012 12:30:58.344 client endrequest

my question is... is this normal? should i be worried? or is this completely irrelevant to my data charges, and i should wait to see more data from bandwidthd?

thank you in advance.

share|improve this question
up vote 7 down vote accepted

It looks to me your server is being used in a DNS amplification attack.
I don't know the pricing model of Amazon EC2, but I'd be surprised if this traffic didn't count.

It works like this:
Someone is sending a DNS query to your server with the spoofed IP
Your server answers this query to the real victim -
The query is pretty small, but the answer is quite big (check dig -t ANY

The real question is, why does your server answer these queries?
Are you intentionally running an public recursive DNS for everybody to use?

If not, you need to disable recursion or limit it to trusted/known clients (recursion no; and allow-query-cache {none;};).

share|improve this answer
Good answer. Some references: Ars Technica article about Anonymous' use of this technique; US-CERT paper (pdf) with links and how-tos for configuring the major DNS servers. – bonsaiviking Nov 17 '12 at 12:34
thanks a ton. i wasn't aware of the dangers of recursion... now it's set to allow only a trusted list of IPs. and thanks a lot for the detailed explanation, makes a lot of sense now :) – Waleed Hamra Nov 17 '12 at 12:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.