-1
votes
2answers
81 views

How to handle an abuse complaint? [closed]

I have just received an abuse complaint from my hosting service: [2014-04-04 03:30:23 CET] [Timestamp:1396575024] [11717182.634230] Firewall: *UDP_IN Blocked* IN=eth0 OUT= SRC=My IP ...
-4
votes
2answers
62 views

DNS over TCP not udp [closed]

A Network problem with ISP caused all UDP traffic to cease, but DNS still working though I think it is malfunctioning. How to prove for sure using software that my current DNS queries are resolved ...
0
votes
0answers
158 views

Users can't send mail message - mx record for site getting Truncated, retrying in TCP mode

System setup: Linux Red Hat Enterprise Linux ES release 4 (Nahant Update 9), Postfix mail server I have a user who is trying to send an e-mail. E-Mail on this server has been working for years ...
0
votes
1answer
269 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
0
votes
2answers
2k views

Problems with MDNS flooding on port 5353 UDP

I am running into a big issue at a small network i manage. This network is an Apple network, with airport extremes, expresses, mac book pro's, imac's, ipads, iphones etc... I went to add something to ...
0
votes
1answer
959 views

Too much traffic on UDP suspecting bind miss-configuration

A server generates over 600GB of monthly traffic on UDP port (while http is under 1GB), so I ran tcpdump command and I see many (over 10/second or so) fast dns related commands/traffic that looks like ...
0
votes
1answer
155 views

Confused! php-cgi opened (and didn't close) a UDP “connection” …but isn't UDP connectionless?

This question is more for my own education than to solve any problem. I am running a VPS at linode w/ lighttpd and PHP 5.3.13 via fast-cgi. When I list internet connections, I get this strange ...
2
votes
1answer
533 views

enable large DNS queries on Microsoft 2008 R2 DNS server

When I run the Network analyzer at http://netalyzr.icsi.berkeley.edu/ it reports: The resolver at could not process the following tested types: Medium (~1300B) TXT records Large (~3000B) TXT ...
2
votes
2answers
900 views

IPtables: is there a minimum UDP packet size for a DNS lookup?

IPtables for a virtual dedicated server. I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup? Nmap sends 0-byte UDP packets (source : ...
2
votes
1answer
1k views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
0
votes
2answers
684 views

Which UDP ports are required to resolve external hosts?

Today I asked my hoster to block all UDP ports except port 53. Due to daily UDP attacks, this was currently the only option to stop flooding my lines. Now since the block is in place, I cannot wget ...
1
vote
2answers
8k views

How do you prevent UDP-flood based DDOS attacks on a DNS server? [duplicate]

I'm studying networking at the moment, and it just occurred to me that one can easily forge DNS requests with fake IP addresses (since they use UDP). Since DNS relies on UDP for communication, ...
0
votes
1answer
6k views

DNS SERVFAIL and Incorrect Flag only via TCP: Broken DNS Servers?

Is it poor configuration to return the root name servers in the additional section for a CNAME lookup that points to another domain? Particularly the one I'm seeing this with is a CNAME hosted by ...
4
votes
2answers
6k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...