North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: DNS requests from 209.67.50.203
John Kristoff wrote: > > On a university list many sites are reporting large amounts of traffic > appearing to come from 209.67.50.203 to their DNS servers. The > administrator of the source IP (spoofed of course) is the victim of a > brutal DoS attack. The traffic is UDP/DNS queries that are appear to be > going directly to available DNS servers (as opposed to random hosts). > Most sites are reporting on the order of 6 or more packets per second to > their DNS servers. The victim has apparently seen upwards of 90 Mb/s of > traffic coming back in to them. Does anyone here have anymore > information on this attack? In general, this attack method is known. There is some information about it documented at: Denial of Service Attacks Using Nameservers http://www.cert.org/incident_notes/IN-2000-04.html Regards, Kevin
|