[AusNOG] DNS reflection attack

Steven Lisson stevel at dedicatedservers.net.au
Thu Jan 22 21:30:20 EST 2009


I think you will find that many people's servers are involved in this
type of attack (have seen it on our network and blocking where
appropriate on a network level), there has been extensive discussion on
the Nanog list about it and would recommend reading the archives if your

One of the destinations attacked/spoofed, ISPrime (the last two IP's
mentioned) has said that the two IP's were authoritative nameservers and
should not make DNS requests so blocking any requests from them to port
53 should block any illegitimate traffic.


-----Original Message-----
From: ausnog-bounces at lists.ausnog.net
[mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Tom Storey
Sent: Thursday, 22 January 2009 7:45 PM
To: ausnog at ausnog.net
Subject: [AusNOG] DNS reflection attack

Is anyone else unfortunate enough to be "participating" in a DNS
reflection attack at present?

A few days ago I discovered that I had been part of one starting about
days earlier. I promptly ACL'd off the (spoofed) source IP in question
spare the disk on the box running my DNS server (log file was getting
quite large), but it appears that two more IPs are now being targeted.

So far the 3 that I have seen are:

The first IP seemed to host a bunch of shemale related websites
to a simple google search for the IP), I can only guess the next two do

Others might like to check whether they are seeing anything from these
IPs, and block them out too.

Im seeing ~5 requests/sec combined from the second and 3rd IPs at the

Unfortunately this is hitting me on my home DSL connection.


AusNOG mailing list
AusNOG at lists.ausnog.net

More information about the AusNOG mailing list