Re: empty DoS queries

2009-02-24 Thread Frank Kirschner
10.48.0.19 is a WLAN Router with DNS Cache, WAN=> WLAN, LAN=>local network. Normally the Router should cache all queries coming from the LAN. I belive, the PC inside the LAN has a virus or trojan and floods the WRT router. I have contacted the user and after disconnet the PC behind, everything

Re: empty DoS queries

2009-02-23 Thread Mark Andrews
I suspect you have a broken application on 10.48.0.19. Mark In message <70fo2df49pf...@mid.individual.net>, Frank Kirschner writes: > Hello, > since last night we log emtpty queries (approx. 4000 per seconds) like > this from a client in our LAN: > > 23-Feb-2009 13:20:15.516 qu

Re: empty DoS queries

2009-02-23 Thread Stephane Bortzmeyer
On Mon, Feb 23, 2009 at 02:20:03PM +0100, Frank Kirschner <147...@celebrate.de> wrote a message of 65 lines which said: > 23-Feb-2009 13:20:15.516 queries: info: client 10.48.0.19#2048: query: > \(none\) IN A + I have no idea. But capturing such queries with something like: tcpdump -w dos-o

empty DoS queries

2009-02-23 Thread Frank Kirschner
Hello, since last night we log emtpty queries (approx. 4000 per seconds) like this from a client in our LAN: 23-Feb-2009 13:20:15.516 queries: info: client 10.48.0.19#2048: query: \(none\) IN A + 23-Feb-2009 13:20:15.518 queries: info: client 10.48.0.19#2048: query: \(none\) IN A + 23-Feb-200

empty DoS queries

2009-02-23 Thread Frank Kirschner
Hello, since last night we log emtpty queries (approx. 4000 per seconds) like this from a client in our LAN: 23-Feb-2009 13:20:15.516 queries: info: client 10.48.0.19#2048: query: \(none\) IN A + 23-Feb-2009 13:20:15.518 queries: info: client 10.48.0.19#2048: query: \(none\) IN A + 23-Feb-200