DNS query spam

December 1, 2005

Hi all,

Recently my DNS servers get jammed with bogus queries. The attacks come in
series, taking a few minutes each, sometimes from different IPs at the
same time, at least twice a day.

23:05:40.241026 IP 204.92.73.10.40760 > xx.xx.xx.xx.53: 38545+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:41.600902 IP 204.92.73.10.16561 > xx.xx.xx.xx.53: 22242+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:42.091743 IP 204.92.73.10.37547 > xx.xx.xx.xx.53: 64644+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:43.433539 IP 204.92.73.10.32370 > xx.xx.xx.xx.53: 31772+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:43.854481 IP 204.92.73.10.12913 > xx.xx.xx.xx.53: 33470+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:44.378640 IP 204.92.73.10.62484 > xx.xx.xx.xx.53: 8726+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:45.368970 IP 204.92.73.10.57384 > xx.xx.xx.xx.53: 1073+ [1au] ANY ANY? e.mpisi.com. (40)
23:05:45.379251 IP 204.92.73.10.36997 > xx.xx.xx.xx.53: 22257+ [1au] ANY ANY? e.mpisi.com. (40)

Has anyone noticed a similar activity?

Best regards,
Piotr Kamisiński

My DNS servers were attacked the similar way in the beginning of this year.
All queries were originated from a lot of sources. Senders of these packets
were not bogus obviously, because after firewalling incoming requests from
any of them, the rate of flooding became lower. All requests were made to one
of my domains.

Daily DNS traffic was about 400-500 Mb.

To automate the firewalling process I wrote a program, that sniffed DNS
traffic and automatically added to firewall DROP rules.

I have the same problem, now I’m blocking this attempts with iptables and
the Recent module when a number of tries is reached.

This is the content of the packet:
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/20/05-19:17:37.177173 168.143.XXX.XX:11752 -> YYY.YYY.Y.YY:53
UDP TTL:233 TOS:0×0 ID:34960 IpLen:20 DgmLen:68 DF
Len: 48
0×0000: 00 07 95 C2 6A 32 00 04 76 DA CB 14 08 00 45 00 ….j2..v…..E.
0×0010: 00 44 88 90 40 00 E9 11 2A D5 A8 8F 71 0A C0 A8 .D..@…*…q…
0×0020: 04 01 2D E8 00 35 00 30 00 00 20 9E 01 00 00 01 ..-..5.0.. …..
0×0030: 00 00 00 00 00 01 01 65 05 6D 70 69 73 69 03 63 …….e.mpisi.c
0×0040: 6F 6D 00 00 FF 00 FF 00 00 29 27 10 00 00 00 00 om…….)’…..
0×0050: 00 00 ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Regards,

Josep Ma Castells

I was seeing this kind of thing last month. I suspect that it’s part
of a DDoS attack on the IP address that the queries claim to come
from, but it could also be an attack on your DNS server. The idea is
that the attacker sends a small bogus DNS query on UDP port 53 with a
bogus IP address. Your server then sends a much larger response to
that IP address, greatly multiplying the amount of traffic that the
attacker can direct at the target site. This occurs via UDP since
that makes it easy to spoof the source address.

Assuming you use Bind, can edit your named.conf file, only wish to
provide recursive DNS services (ie. handle queries for domains that
you are not authoritative for) to a known range of IP addresses, and
the query is for a domain that you’re not authoritative for, you can
solve the problem by adding something like this to named.conf:

options {
allow-recursion { 127.0.0.1/32; };
};

That particular setting would cause Bind to ignore recursive queries
from all IP addresses except 127.0.0.1 (localhost). My DNS server
only provides recursive queries for itself, so the setting was easy
for me. After I started blocking recursive queries, it took a week
or so for the bogus traffic to stop. But in the mean time, since I
wasn’t sending responses, the amount of my bandwidth that was wasted
decreased dramatically.

204.92.73.10 is one of the IP addresses for irc.efnet.ca. Someone is
spoofing the source addresses, in the hope that DNS servers will
return a large record set.

Could you check if the packets contain OPT records (e.g. using
“tcpdump -s 0 -v”)? This protocol extension is described in the RFC
for ENDS0 (RFC 2671). EDNS0-capable DNS resolvers can send fragmented
UDP packets, exceeding the traditional 512 byte limit of DNS UDP
replies. The BIND 9 default maximum response size is 4096, for
example.

If the spoofed requests contain OPT records , you typically get an
amplification factor of about 60 in terms of bandwidth, and 5 in terms
of packet rate, but actual numbers may vary.

Yet another reason to restrict access to your recursive resolvers to
customers only.

Posted in Q & A