[dns-operations] New subscribers

[Michael Graff]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 2011-01-11 9:29 AM, John Kristoff wrote:
> On Tue, 11 Jan 2011 12:47:24 +0100
> bert hubert <bert.hubert at netherlabs.nl> wrote:
> 
>> A big resolver operator reported 5000 incoming ISC.ORG/ANY
>> queries/second on his very much production servers.  Goes a bit
>> beyond exploratory scanning.
> 
> Thanks for the info Bert, that is quite a bit different than what I
> saw.  Could have been unrelated or perhaps they were testing the
> resolvers I saw to perform the activity against other resolvers you
> mentioned.  If you have any further details of the source and packets
> or you can ask said operator to touch base with me I'd be interested
> to hear from them.  Perhaps we can uncover some additional insight.

One report we've received here at ISC is that all the source ports are
identical.  Is this the case for you as well?

- --Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk0seiAACgkQLdqv0r6eD6bCtwCgjdij9MffdlPPLr8uDSayXgm8
lqwAn1U4jp8wZmBpi1ohGpqCI4/1fHou
=lslz
-----END PGP SIGNATURE-----