Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

recently I discovered that my server was generating a lot more traffic than normal.

Normally I get around 1-10 Mb per day, since the server only works as a host for eMail and static websites.

However, in the last three days it generates more than 200 Mb per day.

While I haven't figured out the problem exactly, the following seems very suspicious to me.

When running tshark from the console I get continuous requests like these:

19.825601 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt3.fixlarge.com
19.831944 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt3.fixlarge.com
19.842562 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt409.tekjeton.com
19.844480 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt3.fixlarge.com
19.846354 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt9.triton1337.net
19.846561 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt9.triton1337.net
19.848314 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt409.tekjeton.com
19.851613 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt3.fixlarge.com
19.851625 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt9.triton1337.net
19.852715 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt409.tekjeton.com
19.854063 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt9.triton1337.net
19.866565 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt3.fixlarge.com
19.866582 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt409.tekjeton.com
19.870774 199.250.62.3 -> 78.46.177.18 DNS Standard query TXT txt3.fixlarge.com

While I do know what TXT basically is, this does not make any sense to me.

When I read the DNS TXT record it just contains data that does not make any sense to me.

Questions are:

Do you guys know what the TXT data means here Can you tell me what the general hazardous potential is here? Maybe my server got compromised and these queries have a deeper meaning or are the precursor to another problem? This beeing said, I had a dummy DNS server running on the machine that always delivered a static response (similar to the NX-Domain fallback from OpenDNS).

Till now I have shutdown the process and blocked the IP via iptables. However, the requests still showup in tshark, which is because of the level where tshark captures the packets I think.

share|improve this question
2  
That does look deeply suspicious. The data returned by the txt lookup is rather large and garbage. One string repeated over and over again, creating a return just under 4KB. This could be an attempt at a denial-of-service, a stream of small size requests yielding a much larger stream of responses. –  sysadmin1138 Apr 1 '13 at 11:27
4  
Yes, looks like you are the weapon in DNS amplification attack (source address maybe spoofed). –  slimsuperhero Apr 1 '13 at 11:30
2  
Please check that you are not configured as an open resolver. dns.measurement-factory.com/cgi-bin/openresolvercheck.pl dns.measurement-factory.com/surveys/openresolvers.html –  grifferz Apr 1 '13 at 14:00
    
Thanks for your support guys. As stated earlier, the DNS server was already put down. I did restart it and tested it again, although it was tested on startup if it was an open resolver. Turned out, it still is no open resolver. So it seems like these requests are just fired in the wild with the intention to maybe hit a relevant server. –  user2161635 Apr 5 '13 at 12:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.