Ian Batterbee wrote:

Further to that, it looks like we're being hit by this

http://foxpa.ws/2010/07/21/thwarting-the-isc-org-dns-ddos/

which is a very large number of clients all making ANY requests for isc.org http://isc.org.

The problem is that a lot of the source addresses are within our network, suggesting that we either have a lot of infected customers, or they're spoofed and someone is targeting our customers with unsolicted dns responses.

Are you certain the traffic you saw match the pattern of the attack described in that blog post? The reason I think they are using is because isc.org is signed and the response is large (1436 bytes) if you query using EDNS0 set. If you or someone else you saw the attack has a sample, I'd love to get a hand on it and do some dissection. BTW, we didn't see any abnormal traffic in .nz nameservers cheers,

On 5 November 2010 09:04, Ian Batterbee mailto:ibatterb(a)gmail.com> wrote:

Looks like a new DDOS out there.. anyone else seeing it ?

------------------------------------------------------------------------

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

-- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

On Fri, Nov 5, 2010 at 14:26, Dobbins, Roland wrote:

records which return large answers in response to small queries.

Amplification, why babies love rattles.

Roland Dobbins

Hamish. -- http://tr.im/HKM