forum.lissyara.su

Добавлено: **2012-03-11 22:46:34**

Заметил что на мой сервер вырос DNS трафик.
tcpdump показал следующее

21:40:53.521528 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 13533+ [1au] ANY? isc.org. (36)
21:40:53.571334 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 4569+ [1au] ANY? isc.org. (36)
21:40:53.610508 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 23400+ [1au] ANY? isc.org. (36)
21:40:53.610677 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 11759+ [1au] ANY? isc.org. (36)
21:40:53.852381 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 10362+ [1au] ANY? isc.org. (36)
21:40:53.888117 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 52827+ [1au] ANY? isc.org. (36)
21:40:54.016690 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 44269+ [1au] ANY? isc.org. (36)
21:40:54.019682 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 45989+ [1au] ANY? isc.org. (36)
21:40:54.035115 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 21698+ [1au] ANY? isc.org. (36)
21:40:54.178890 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 13467+ [1au] ANY? isc.org. (36)
21:40:54.427331 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 24357+ [1au] ANY? isc.org. (36)
21:40:54.446899 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 33327+ [1au] ANY? isc.org. (36)
21:40:54.463951 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 3691+ [1au] ANY? isc.org. (36)
21:40:54.504222 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 61417+ [1au] ANY? isc.org. (36)
21:40:54.692598 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 44313+ [1au] ANY? isc.org. (36)
21:40:54.804824 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 37475+ [1au] ANY? isc.org. (36)
21:40:54.979064 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 35255+ [1au] ANY? isc.org. (36)
21:40:55.162428 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 54302+ [1au] ANY? isc.org. (36)
21:40:55.375043 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 49802+ [1au] ANY? isc.org. (36)
21:40:55.410026 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 45660+ [1au] ANY? isc.org. (36)
21:40:55.441146 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 3239+ [1au] ANY? isc.org. (36)
21:40:55.648770 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 19749+ [1au] ANY? isc.org. (36)
21:40:55.703451 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 2749+ [1au] ANY? isc.org. (36)
21:40:55.929717 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 24268+ [1au] ANY? isc.org. (36)
21:40:55.973110 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 9997+ [1au] ANY? isc.org. (36)
21:40:56.106355 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 42043+ [1au] ANY? isc.org. (36)
21:40:56.130559 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 13753+ [1au] ANY? isc.org. (36)
21:40:56.214149 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 25112+ [1au] ANY? isc.org. (36)
21:40:56.323711 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 5034+ [1au] ANY? isc.org. (36)
21:40:56.323882 IP 199.59.164.182.80 > xxx.xxx.xxx.xxx.53: 34116+ [1au] ANY? isc.org. (36)
21:40:56.566067 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 63901+ [1au] ANY? isc.org. (36)
21:40:56.664912 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 17841+ [1au] ANY? isc.org. (36)
21:40:56.905210 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 36071+ [1au] ANY? isc.org. (36)
21:40:56.938220 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 11337+ [1au] ANY? isc.org. (36)
21:40:56.945873 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 37173+ [1au] ANY? isc.org. (36)
21:40:57.274036 IP 72.251.250.98.80 > xxx.xxx.xxx.xxx.53: 60495+ [1au] ANY? isc.org. (36)

как видно, с 80-го порта луплят запросы на мой DNS.
фаерволом закрыл, но запросы продолжают поступать.
Это можно расценивать как dos-атаку?

Добавлено: **2012-03-12 5:38:31**

Запросы слишком редко приходят для ддоса. У себя тоже такое давно замечал:

Mar 12 01:11:28 life-in named[1516]: 12-Mar-2012 01:11:28.647 queries: client 188.227.187.90#55547: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:29 life-in named[1516]: 12-Mar-2012 01:11:29.214 queries: client 188.227.187.90#14811: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:29 life-in named[1516]: 12-Mar-2012 01:11:29.522 queries: client 188.227.187.90#306: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:29 life-in named[1516]: 12-Mar-2012 01:11:29.579 queries: client 188.227.187.90#57514: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:29 life-in named[1516]: 12-Mar-2012 01:11:29.587 queries: client 188.227.187.90#8035: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:29 life-in named[1516]: 12-Mar-2012 01:11:29.873 queries: client 188.227.187.90#45597: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:30 life-in named[1516]: 12-Mar-2012 01:11:30.528 queries: client 188.227.187.90#40228: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:30 life-in named[1516]: 12-Mar-2012 01:11:30.529 queries: client 188.227.187.90#40212: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:30 life-in named[1516]: 12-Mar-2012 01:11:30.983 queries: client 188.227.187.90#15569: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:31 life-in named[1516]: 12-Mar-2012 01:11:31.187 queries: client 188.227.187.90#63357: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:31 life-in named[1516]: 12-Mar-2012 01:11:31.472 queries: client 188.227.187.90#11653: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:31 life-in named[1516]: 12-Mar-2012 01:11:31.845 queries: client 188.227.187.90#35152: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:32 life-in named[1516]: 12-Mar-2012 01:11:32.408 queries: client 188.227.187.90#3114: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:32 life-in named[1516]: 12-Mar-2012 01:11:32.502 queries: client 188.227.187.90#35758: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:33 life-in named[1516]: 12-Mar-2012 01:11:33.158 queries: client 188.227.187.90#40807: query: isc.org IN ANY +ED (212.48.42.142)
Mar 12 01:11:33 life-in named[1516]: 12-Mar-2012 01:11:33.354 queries: client 188.227.187.90#55673: query: isc.org IN ANY +ED (212.48.42.142)

причем запросы прилетают только с одного адреса в момент Х, но вообще адреса меняются.

Код: Выделить всё

213.186.61.105
46.105.36.36
66.96.214.229
66.96.2.3
109.200.1.202
94.23.147.151
108.59.8.103
81.94.195.229
108.59.8.103
81.94.195.229
108.59.8.103
81.94.195.229
68.233.234.148
174.127.92.76
108.59.11.229
81.94.195.229
108.170.22.70
173.208.196.228
108.170.22.70
94.76.224.137
94.229.64.210
71.225.236.95
46.105.36.36
206.217.209.32
68.233.234.148
213.186.33.19
193.36.45.139
149.3.140.75
64.40.8.50
188.227.187.90

forum.lissyara.su

Непонятные запросы к DNS'у

Непонятные запросы к DNS'у

Re: Непонятные запросы к DNS'у