North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Question about strain on the A root server

  • From: jlewis
  • Date: Sun Apr 23 01:38:50 2000

On Sat, 22 Apr 2000, Dirk Harms-Merbitz wrote:

> That's what we thought initially. Somebody processing logfiles.
> 
> Doesn't look like it though. A remote machine makes our top ten
> list and then stays there for days. If we block on a router level
> then it seems to get fixed eventually on the other end.

If you're looking at the stats enough to pin down heavy usage to
individual systems, it shouldn't be too much more work to track down why
they're suddenly making the top ten list.  i.e. is it a bug in their
resolver, or were they hacked and running some scanner kit that makes
heavy use of DNS, with A hard-coded into the scanner?

----------------------------------------------------------------------
 Jon Lewis *[email protected]*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |  
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________