Date: Tue, 16 Dec 2003 22:01:33 +0100 From: "Robert Eckardt" <Robert.Eckardt@Robert-Eckardt.de> To: questions@freebsd.org Subject: DOS of named Message-ID: <20031216191701.M14568@Robert-Eckardt.de>
next in thread | raw e-mail | index | archive | help
Hi,
what measures can I take against this irregular appearing Denial-Of-Service
attacks of named which is filling my logfiles (messages, daemon, all.log)
with messages like "sysquery: no addrs found for root NS" for minutes at
a rate of 4000 lines/sec?
I'm using named 8.3.3-REL on FBSD-5.0R.
There is no indication that ipfw is blocking anything as denied packets
are logged by default. (Well, at least not from any name servers.)
This phenomenon happens irregularly after a few days/weeks/months.
This last event, for example, happend after 4 days uptime, the one before
after over 42 days.
Searching in the archives pointed me to
a) some issue with the named.cache file which I updated weeks ago and
which is still up-to-date
b) the firewall blocking the answer from a root-server (see above)
c) and of course the arrogance of a developer suggesting to use a larger
filesystem for logs as nothing is wrong with an application logging
every error.
Thus, nothing to solve the problem or to find the true cause.
An "nslookup 198.41.0.4 a.root-servers.net." produces
Authoritative answers can be found from:
198.in-addr.arpa nameserver = chia.ARIN.NET
198.in-addr.arpa nameserver = dill.ARIN.NET
198.in-addr.arpa nameserver = henna.ARIN.NET
198.in-addr.arpa nameserver = indigo.ARIN.NET
198.in-addr.arpa nameserver = epazote.ARIN.NET
198.in-addr.arpa nameserver = figwort.ARIN.NET
198.in-addr.arpa nameserver = ginseng.ARIN.NET
*** Can't find server name for address 198.41.0.4: No information
*** Default servers are not available
Tcpdump shows the following transfer, nothing more:
tcpdump: listening on tun0
20:47:47.288874 80.128.176.76.63384 > 198.41.0.4.domain: 18833+ PTR?
4.0.41.198.in-addr.arpa. (41)
0x0000 4500 0045 9dbf 0000 4011 15ef 5080 b04c E..E....@...P..L
0x0010 c629 0004 f798 0035 0031 0b4a 4991 0100 .).....5.1.JI...
0x0020 0001 0000 0000 0000 0134 0130 0234 3103 .........4.0.41.
0x0030 3139 3807 696e 2d61 6464 7204 6172 7061 198.in-addr.arpa
0x0040 0000 0c00 01 .....
20:47:47.443400 198.41.0.4.domain > 80.128.176.76.63384: 18833- 0/7/0 (194)
(DF)
0x0000 4500 00de 0000 4000 3411 7f15 c629 0004 E.....@.4....)..
0x0010 5080 b04c 0035 f798 00ca 7663 4991 8100 P..L.5....vcI...
0x0020 0001 0000 0007 0000 0134 0130 0234 3103 .........4.0.41.
0x0030 3139 3807 696e 2d61 6464 7204 6172 7061 198.in-addr.arpa
0x0040 0000 0c00 01c0 1300 0200 0100 0151 8000 .............Q..
0x0050 0f04 6368 6961 0441 5249 4e03 4e45 5400 ..chia.ARIN.NET.
0x0060 c013 0002 0001 0001 5180 0007 0464 696c ........Q....dil
0x0070 6cc0 3ac0 1300 0200 0100 0151 8000 0805 l.:........Q....
0x0080 6865 6e6e 61c0 3ac0 1300 0200 0100 0151 henna.:........Q
0x0090 8000 0906 696e 6469 676f c03a c013 0002 ....indigo.:....
0x00a0 0001 0001 5180 000a 0765 7061 7a6f 7465 ....Q....epazote
0x00b0 c03a c013 0002 0001 0001 5180 000a 0766 .:........Q....f
0x00c0 6967 776f 7274 c03a c013 0002 0001 0001 igwort.:........
0x00d0 5180 000a 0767 696e 7365 6e67 c03a Q....ginseng.:
^C
Thanks in advance,
Robert
PS: BTW, is there a search engine on freebsd.org for the archives or
do I have to stay with google, which becomes less usable each day?)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031216191701.M14568>