> On May 7, 2018, at 7:07 AM, John Miller JR <johnmillerj...@gmail.com> wrote: > > Hello, > On bind recursive server I am seeing lots of queries for "." with type ANY. > Is there any use case which requires devices to send queries for "." with > type ANY ?
There could be a legitimate use case. But the most common use of such queries is to conduct an amplification attack. What are the apparent source addresses of these queries? Are they consistent? If so, that would point to the target of such an attack, not the source. Chris Buxton _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
