Server overwhelmed by rejections?

Dylan Martin dmartin at sccd.ctc.edu
Sat Jan 16 04:41:19 UTC 2010


I recently had an odd occurrence with my DNS servers. I have two
servers that act as caching resolvers for a community college and
authoritative for the college's domain.  A few days ago they both
stopped working  for about 15 minutes.  The only clue I've been able
to find is my logs contain an unusual number of rejected querys right
before the outage.  By unusual, I mean around 300 in 2 seconds when a
busy one-second span might contani 25 entries normally.  These
requests were rejected because they originated from an IP address for
which recursive queries are forbidden.

Has anyone heard of excessive rejections causing an outage?  Is there
anything I can do to prevent this kind of thing from happening again?
I'm pretty sure this was just a fluke, but I worry what would happen
if a disgruntled student wanted to launch a DOS.

Thanks!
-Dylan



More information about the bind-users mailing list