<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span></span></div><div>My methodology is simple, analyze and ban :)<br>
<br>
First Part<br>
+ Baseline = Identifying the anomalies<br>
* Using latency monitor .<br>
-> <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">smokeping</span>, In-house scripts instead of dig I prefer using Net::<span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">DNS</span> for the customizable <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">outout</span>, etc... .<br>
* Ratio of <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">dns</span>-query/<span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">dns</span>-response (in/out <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">mbps</span>) <br>
-> roughly in/out traffic in my cases are 1/4<br>
* <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">Ascii</span>/<span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">RRD</span> like graphs :), same as the above case, but just looking the behavior of the traffic picture.<br>
<br>
+ Random auditing, packet sampling in a limited time frame. It is best suited for if you have got a lot of <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">dns</span>-servers and want to identify if there is an amplification attack present or not. <br>
-> <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">tcpdump</span> + grep/<span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">sed</span>/<span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">awk</span> + "<span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">wc</span> -l" or <span style="background:none repeat scroll 0% 0% yellow;" class="yiv636695792J-JK9eJ-PJVNOc">dnstop</span> :) ,etc.. <br>
Last Part</div><div style="color:rgb(0, 0, 0);font-size:16px;font-family:times new roman, new york, times, serif;background-color:transparent;font-style:normal;"><span class="yiv636695792tab"> +Banning traffic : Signature of the packet (dns-type + dns query) then importing them to firewall</span></div><div style="color:rgb(0, 0, 0);font-size:16px;font-family:times new roman, new york, times, serif;background-color:transparent;font-style:normal;"><br></div><div style="color:rgb(0, 0, 0);font-size:16px;font-family:times new roman, new york, times, serif;background-color:transparent;font-style:normal;"><br>
Serhat Aslan<br>
</div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Robert Schwartz <smellyspice@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> dns-operations@lists.dns-oarc.net <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, September 11, 2012 6:52 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> [dns-operations] DNS ANY record queries - Reflection Attacks<br> </font> </div> <br>
<div id="yiv2031878508">Hi All,<br><br>We run a bunch of authoritative servers and have recently observed activity best described in a post we found here: <a rel="nofollow" target="_blank" href="https://isc.sans.edu/diary/DNS+ANY+Request+Cannon+-+Need+More+Packets/13261">https://isc.sans.edu/diary/DNS+ANY+Request+Cannon+-+Need+More+Packets/13261</a><br>
<br>Using the iptables rules posted as a comment by <span class="yiv2031878508commentauthor">Network Mouse (in the above post), we've been able to reduce the amount of junk being sent to the target host.</span> <span class="yiv2031878508commentauthor"><span class="yiv2031878508commentauthor">Most of the target hosts seem to be in Asia, just like those mentioned in the Sans post. <br>
<br></span>The question I have for you all is: Is this something affecting other operators? How have you been dealing with it? <br><br>Thanks in advance for your feedback.<br><br>-Rob<br><br><br><br></span>
</div><br>_______________________________________________<br>dns-operations mailing list<br><a ymailto="mailto:dns-operations@lists.dns-oarc.net" href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>dns-jobs mailing list<br><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br><br> </div> </div> </div></body></html>