I'm seeing a lot of hosts in my named logs (I mean log files, it's not like I am naming my poop)
...ok... silly joke hehe So anyway, named bind is reporting a lot of denied queries of type 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which is to immediately block the IPs for port 53 after as few as one denied query) - but I want to warn server admins who haven't spotted both these queries and other denied queries. Common sense suggests that these hosts are probably spoofed IPs. Looks like an effective way to ddos a host: request an arbitrary DNS record with a spoofed IP and let the server reply to the spoofed IP in whatever way. Do that with many hosts and there is your denial of service. A side effect is that when you block the IP, you're blocking something that isn't really doing anything wrong as it's a spoofed IP But ok, I'm not too sure of this so please shoot holes in my theory or suggest better fixes/workarounds/... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/