[dns-operations] New subscribers

John Kristoff jtk at cymru.com
Mon Jan 10 15:37:47 UTC 2011

On Mon, 10 Jan 2011 10:48:47 +1100
Mark Andrews <marka at isc.org> wrote:

> It's almost cerrtainly a attempted DNS amplification attack.  The
> source address and port will be forged.  Very few stub clients

Hi Mark,

I suspect in this particular case it was no an amplification attack,
because it was aimed at one or more resolvers that will not answer at
all.  At best they would refused response.  I suspect it was some sort
of exploratory scanning, just not sure who was doing or why.  Sometimes
folks come forward, sometimes not.  :-)


More information about the dns-operations mailing list