Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

recently I discovered that my server was generating a lot more traffic than normal.

Normally I get around 1-10 Mb per day, since the server only works as a host for eMail and static websites.

However, in the last three days it generates more than 200 Mb per day.

While I haven't figured out the problem exactly, the following seems very suspicious to me.

When running tshark from the console I get continuous requests like these:

19.825601 -> DNS Standard query TXT
19.831944 -> DNS Standard query TXT
19.842562 -> DNS Standard query TXT
19.844480 -> DNS Standard query TXT
19.846354 -> DNS Standard query TXT
19.846561 -> DNS Standard query TXT
19.848314 -> DNS Standard query TXT
19.851613 -> DNS Standard query TXT
19.851625 -> DNS Standard query TXT
19.852715 -> DNS Standard query TXT
19.854063 -> DNS Standard query TXT
19.866565 -> DNS Standard query TXT
19.866582 -> DNS Standard query TXT
19.870774 -> DNS Standard query TXT

While I do know what TXT basically is, this does not make any sense to me.

When I read the DNS TXT record it just contains data that does not make any sense to me.

Questions are:

Do you guys know what the TXT data means here Can you tell me what the general hazardous potential is here? Maybe my server got compromised and these queries have a deeper meaning or are the precursor to another problem? This beeing said, I had a dummy DNS server running on the machine that always delivered a static response (similar to the NX-Domain fallback from OpenDNS).

Till now I have shutdown the process and blocked the IP via iptables. However, the requests still showup in tshark, which is because of the level where tshark captures the packets I think.

share|improve this question
That does look deeply suspicious. The data returned by the txt lookup is rather large and garbage. One string repeated over and over again, creating a return just under 4KB. This could be an attempt at a denial-of-service, a stream of small size requests yielding a much larger stream of responses. – sysadmin1138 Apr 1 '13 at 11:27
Yes, looks like you are the weapon in DNS amplification attack (source address maybe spoofed). – Gevial Apr 1 '13 at 11:30
Please check that you are not configured as an open resolver. – grifferz Apr 1 '13 at 14:00
Thanks for your support guys. As stated earlier, the DNS server was already put down. I did restart it and tested it again, although it was tested on startup if it was an open resolver. Turned out, it still is no open resolver. So it seems like these requests are just fired in the wild with the intention to maybe hit a relevant server. – user2161635 Apr 5 '13 at 12:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.