Bind 9 not responding to queries

[John W. Blue]

Sir Izake,

Any network troubleshooting starts with finding out what is being placed on the wire.  In your particular example it sounds like you need to validate if this Cent box is seeing a SYN flood.  You do this by using tcpdump.

Assuming you only have one ethernet adapter (which by extension rules out its use as a proxy or a bridge) you would issue the following command:

sudo tcpdump 'tcp[13] & 2!=0'

You should see something like this start showing up:

10:27:43.627614 IP 197.2.11.116.33465 > 10.41.32.21.domain: Flags [S], seq 166424657, win 8192, options [mss 1400,nop,wscale 8,nop,nop,sackOK], length 0

Source IP is on the left of the > and destination IP is on the right.  From there you can begin to make informed decisions about your next steps.

Finally, if you have never used tcpdump here is a great resource to get started with on how to play around with the different commands:

https://danielmiessler.com/study/tcpdump/

Good hunting!

John


From: bind-users [mailto:bind-users-bounces at lists.isc.org] On Behalf Of sir izake
Sent: Saturday, April 11, 2020 8:42 PM
To: bind-users at lists.isc.org
Subject: Bind 9 not responding to queries

Hi Support

I have installed BIND 9.11.4-P2-RedHat-9.11.4-26.P2.el8 on CentOS Linux release 8.1.1911.

I have configured bind as a recursive server for my network. At specific times of day bind fails to respond to queries even though service is shown to run (configured to respond to my network IPs, this works fine till this time when service fails to answer queries)

I have looked through the logs and found below ;

Apr 10 20:12:43 ##### automatic empty zone: B.E.F.IP6.ARPA
Apr 10 20:12:43 ##### named[25445]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.AR<http://8.B.D.0.1.0.0.2.IP6.AR>>
Apr 10 20:12:43 ##### named[25445]: automatic empty zone: EMPTY.AS112.ARPA
Apr 10 20:12:43  #####  named[25445]: automatic empty zone: HOME.ARPA
Apr 10 20:12:43 ##### named[25445]: none:103: 'max-cache-size 90%' - setting to >
Apr 10 20:12:44 # ##### named[25445]: configuring command channel from '/etc/rndc.>
Apr 10 20:12:44 ##### named[25445]: command channel listening on 127.0.0.1#953
Apr 10 20:12:44 ##### named[25445]: configuring command channel from '/etc/rndc.>
Apr 10 20:12:44 ##### named[25445]: command channel listening on ::1#953

others

Apr 11 22:38:01 ##### systemd[1]: Started Session 29 of user ABC.
Apr 11 22:38:04 #####  dbus-daemon[13352]: [system] Activating via systemd: service name='net.reactivated.Fprint' unit='fprintd.service' requested by ':1.24116' (uid=0 pid=5364 comm="su - " label="unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023")
Apr 11 22:38:04 #####  systemd[1]: Starting Fingerprint Authentication Daemon...
Apr 11 22:38:04 #####  dbus-daemon[13352]: [system] Successfully activated service 'net.reactivated.Fprint'
Apr 11 22:38:04 #####  systemd[1]: Started Fingerprint Authentication Daemon.
Apr 11 22:38:09 #####  kernel: TCP: request_sock_TCP: Possible SYN flooding on port 53. Sending cookies.  Check SNMP counters.
Could  log point to DDoS attack ( how do i mitigate)

I have tried to update bind but it looks like its the stable for Centos 8

Please advise what can be done to prevent the intermittent failures

Regards
Isaac


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200412/a34aecee/attachment-0001.htm>