<div dir="ltr">I too noticed long ago that port <span style="color:rgb(0,0,0);font-family:arial,sans-serif;font-size:13px">25345 was being used by the majority of attacks, so I limited it for a while and recently have blocked DNS "ANY" packets from port 25345 completely. If a legitimate query matches that, it should be retried on a different port, so I don't think I will have a significant 'false positive' problem. I next rate limit "ANY" queries. Both of those are done with iptables. I plan to use rrl in BIND to rate limit what is left, but I am having trouble getting it to work correctly.</span><br>
<div class="gmail_extra"><br></div><div class="gmail_extra">Depending on your traffic, the 1000 queries from the same port might be normal, but for "ANY <a href="http://ISC.ORG">ISC.ORG</a>" it does look awfully high.<br clear="all">
<div><br>-- <br>Bob Harold<br>University of Michigan</div>
<br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><br>
Date: Wed, 3 Apr 2013 10:29:30 -0400<br>
From: <a href="mailto:WBrown@e1b.org">WBrown@e1b.org</a><br>
To: <a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
Subject: [dns-operations] Intersting log analysis<br>
Message-ID:<br>
<<a href="mailto:OF1B491054.F3140DF8-ON85257B42.004E3595-85257B42.004F9A98@e1b.org">OF1B491054.F3140DF8-ON85257B42.004E3595-85257B42.004F9A98@e1b.org</a>><br>
Content-Type: text/plain; charset="US-ASCII"<br>
<br>
I noticed that queries for <a href="http://isc.org" target="_blank">isc.org</a> would come from numerous IP addresses<br>
but the source port would be consistent for long period of times. A<br>
little jiggery with daemon.log and I got the report below where first<br>
column is the number of occurrences of the source port (# separator<br>
changed to space for sort/uniq field definition). The port number is the<br>
only field I used in this, IP address below is just one of many hits for<br>
that port.<br>
<br>
Commands used were:<br>
<br>
sed -e s/#/\ / /var/log/daemon.log |sort -k 8 > ~/sorted<br>
uniq -c -d -f 8 ~/sorted |sort -n -r -k 1 |more<br>
<br>
Does it make sense to look at source port for any level of rate limiting?<br>
<br>
4085406 Apr 1 00:00:00 ns3 named[3407]: client 178.32.36.37 25345<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
113613 Apr 1 00:06:28 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 26451<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
37086 Apr 2 00:10:44 ns3 named[3407]: client 108.59.9.97 49940<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
6388 Apr 1 17:22:07 ns3 named[3407]: client 91.102.165.40 41819<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
5703 Apr 3 01:28:24 ns3 named[3407]: client 178.32.62.37 57335<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
4513 Apr 3 01:41:15 ns3 named[3407]: client 69.60.109.62 32743<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
4009 Apr 1 13:29:08 ns3 named[3407]: client 85.180.66.207 28943<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
3410 Apr 1 21:18:15 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 38299<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
3225 Apr 3 02:07:16 ns3 named[3407]: client 46.105.191.93 31198<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
2505 Apr 1 00:01:18 ns3 named[3407]: limit responses to<br>
<a href="http://216.226.125.0/24" target="_blank">216.226.125.0/24</a><br>
2504 Apr 1 00:01:06 ns3 named[3407]: stop limiting error responses to<br>
<a href="http://216.226.125.0/24" target="_blank">216.226.125.0/24</a><br>
2280 Mar 31 22:55:43 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 18406<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
2231 Apr 2 00:10:44 ns3 named[3407]: client 108.59.9.97 53501<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
2178 Apr 1 15:49:56 ns3 named[3407]: client 178.32.244.171 45813<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1845 Apr 2 18:20:23 ns3 named[3407]: client 62.75.246.181 14716<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1704 Mar 31 15:20:48 ns3 named[3407]: client 176.31.24.240 35853<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1325 Apr 1 14:27:54 ns3 named[3407]: client 37.43.129.10 14898<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1049 Apr 1 18:45:47 ns3 named[3407]: client 178.32.62.37 34424<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1043 Apr 1 20:40:06 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 48733<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1033 Apr 1 13:29:08 ns3 named[3407]: client 85.180.66.207 43639<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1022 Apr 1 19:02:39 ns3 named[3407]: client 208.98.0.3 61182<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
<br>
These are all records where count was above 1000.<br>
<br>
--<br>
<br>
William Brown<br>
Core Hosted Application Technical Team and Messaging Team<br>
Technology Services, WNYRIC, Erie 1 BOCES<br>
<a href="tel:%28716%29%20821-7285" value="+17168217285">(716) 821-7285</a><br>
<br>
<br>
<br>
<br>
Confidentiality Notice:<br>
This electronic message and any attachments may contain confidential or<br>
privileged information, and is intended only for the individual or entity<br>
identified above as the addressee. If you are not the addressee (or the<br>
employee or agent responsible to deliver it to the addressee), or if this<br>
message has been addressed to you in error, you are hereby notified that<br>
you may not copy, forward, disclose or use any part of this message or any<br>
attachments. Please notify the sender immediately by return e-mail or<br>
telephone and delete this message from your system.<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
<br>
<br>
End of dns-operations Digest, Vol 87, Issue 7<br>
*********************************************<br>
</blockquote></div><br></div></div>