Tagged Questions

0
votes
1answer
171 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
0
votes
2answers
415 views

Problems with MDNS flooding on port 5353 UDP

I am running into a big issue at a small network i manage. This network is an Apple network, with airport extremes, expresses, mac book pro's, imac's, ipads, iphones etc... I went to add something to ...
-1
votes
1answer
82 views

Force DNS resolution to use TCP [Mac] [closed]

My comcast internet connection has been giving problems in DNS resolution, and I am guessing the reason is a probably broken or limited UDP. I am currently working around it by tunneling over TCP ...
0
votes
1answer
662 views

Too much traffic on UDP suspecting bind miss-configuration

A server generates over 600GB of monthly traffic on UDP port (while http is under 1GB), so I ran tcpdump command and I see many (over 10/second or so) fast dns related commands/traffic that looks like ...
0
votes
1answer
120 views

Confused! php-cgi opened (and didn't close) a UDP “connection” …but isn't UDP connectionless?

This question is more for my own education than to solve any problem. I am running a VPS at linode w/ lighttpd and PHP 5.3.13 via fast-cgi. When I list internet connections, I get this strange ...
2
votes
1answer
350 views

enable large DNS queries on Microsoft 2008 R2 DNS server

When I run the Network analyzer at http://netalyzr.icsi.berkeley.edu/ it reports: The resolver at could not process the following tested types: Medium (~1300B) TXT records Large (~3000B) TXT ...
2
votes
2answers
639 views

IPtables: is there a minimum UDP packet size for a DNS lookup?

IPtables for a virtual dedicated server. I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup? Nmap sends 0-byte UDP packets (source : ...
1
vote
1answer
368 views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
0
votes
2answers
497 views

Which UDP ports are required to resolve external hosts?

Today I asked my hoster to block all UDP ports except port 53. Due to daily UDP attacks, this was currently the only option to stop flooding my lines. Now since the block is in place, I cannot wget ...
1
vote
2answers
6k views

How do you prevent UDP-flood based DDOS attacks on a DNS server?

I'm studying networking at the moment, and it just occurred to me that one can easily forge DNS requests with fake IP addresses (since they use UDP). Since DNS relies on UDP for communication, ...
0
votes
1answer
4k views

DNS SERVFAIL and Incorrect Flag only via TCP: Broken DNS Servers?

Is it poor configuration to return the root name servers in the additional section for a CNAME lookup that points to another domain? Particularly the one I'm seeing this with is a CNAME hosted by ...
2
votes
2answers
4k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...