[dns-operations] ANONS reflection attack?

[sthaug at nethelp.no]

> In  an ISP  network that I am taking care of in my spare time, we are seeing lots of TXT requests for "ki.ro.lt" to some open recursive nameservers (which we are trying to shot down, but that's not so easy with dnsmasq and distributed Wi-Fi boxes)
> Are you seeing similar attacks at the moment?

Saw quite a bit of it earlier today - spoofed source amplification
attacks directed at 67.192.21.174 and 142.70.144.16.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no