North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: DNS dDos Attack!

  • From: Stephen J. Wilcox
  • Date: Fri Mar 28 09:40:42 2003 
Personally I'd blackhole the traffic at the entry point and work on finding the 
origin.

Assuming its only one of your name servers you can run with one dead...


On Fri, 28 Mar 2003, Dan Armstrong wrote:

> 
> I am sorry if this has come up before, but it seems that one of our name
> 
> servers is under some sort of dDos attack.  It seems to be receiving
> millions of queries form spoofed IPs, and it is spending all of it's
> time sending back icmp unreachables.
> 
> It is running bind 4.31 under BSD 4.62STABLE
> 
> Help!
> 
> Thanks,
> Dan.
> 
>