I'm having thousands of queries a domain isc.org and this increases my cpu percentage to 100%. That may be happening and how I can control this? is an attack? attachment of the log I made an update to version 9.9.2-P2 as recommended but still conti...

Phil Mayers p.mayers at imperial.ac.uk
Tue Apr 16 13:15:28 UTC 2013


On 16/04/13 14:04, Denis Laventure wrote:
>> These seems like some attack going on, after reading the mails i also check my recursive server and found a lot of these in my logs:
>> my server is not an open recursive server its only open to my clients and these are not even from my country.
>
> Same here, my DNS are open to my clients only and are not open resolver. Good to see that I'm not the only one with that problem.
>
> Finally, I got this list of IPs blocked on my firewall and I don't have issue anymore for now :

Instead of blocking the source (which aren't even real - they're 
spoofed) why not just block access to your recursive resolver on port 53.


More information about the bind-users mailing list