I'm having thousands of queries a domain isc.org and this increases my cpu percentage to 100%. That may be happening and how I can control this? is an attack? attachment of the log I made an update to version 9.9.2-P2 as recommended but still continuous problems.

Matus UHLAR - fantomas uhlar at fantomas.sk
Tue Apr 16 08:43:12 UTC 2013


On 15.04.13 10:02, Jose Manuel Delgado G. wrote:
>Subject: I'm having thousands of queries a domain isc.org and this
> increases
>	my cpu percentage to 100%. That may be happening and how I can
> control
>	this? is an attack? attachment of the log I made an update to
> version
>	9.9.2-P2 as recommended but still continuous problems.
>
>190.34.55.70 -> 201.224.83.242 DNS C isc.org. Internet * ?
> 190.33.3.27 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.32.57.243 -> 201.224.83.242 DNS C isc.org. Internet * ?
>201.224.149.40 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.35.22.44 -> 201.224.83.242 DNS C isc.org. Internet * ?
>186.73.76.87 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.34.44.109 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.32.56.118 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.34.27.201 -> 201.224.83.242 DNS C isc.org. Internet * ?
>201.224.115.26 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.32.165.139 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.33.231.148 -> 201.224.83.242 DNS C isc.org. Internet * ?
>190.35.84.29 -> 201.224.83.242 DNS C isc.org. Internet * ?

% host 201.224.83.242
242.83.224.201.in-addr.arpa domain name pointer ns5.cwpanama.net.

inetnum:     190.34/15
status:      allocated
aut-num:     N/A
owner:       Cable & Wireless Panama

inetnum:     201.224/16
status:      allocated
aut-num:     N/A
owner:       Cable & Wireless Panama

they apparently expect your nameserver to provide resursive DNS service for
your company while it may not be intended for that use...  some customers
(well, not only customers...) do not understand the difference between
authoritative and recursive DNS service and may try to use servers for
purpose not intended.  Some may also complain if the service does not work
properly

if you want to be really a bitch, you can set up recursive view with "."
domain providing * records.

-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
REALITY.SYS corrupted. Press any key to reboot Universe.


More information about the bind-users mailing list