3

Currently I run a DNS server (bind9) that handles queries from clients over the internet lately I have noticed hundreds of queries from all different address's that look like this (Server IP removed)

client 216.59.33.210#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 216.59.33.204#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 184.107.255.202#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 205.204.65.83#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 69.162.110.106#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 216.59.33.210#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 69.162.110.106#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 216.59.33.204#53: query: ripe.net IN ANY +ED (0.0.0.0)
client 208.64.127.5#53: query: ripe.net IN ANY +ED (0.0.0.0)

Can someone please explain why there are so many clients querying for ripe.net ?

8
+50

When a DNS-server is configured openly like this it is abused by others in DNS amplifications attacks. The attacker forges the IP-addresses of the DDOS targets and send out a lot of small queries (often of type ANY) to servers like yours.

ripe.net ANY is used because it returns a large answer and therefore amplifies the size of the attackers spoofed query towards the target.

3

Looks like what you want is to disable recursion or allow recursion to specific IP addresses (e.g. local host):

http://www.zytrax.com/books/dns/ch7/queries.html#allow-recursion

The default is to allow anyone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.