<div dir="ltr">The source port should be random from a well behaved client. If you rate limit on source port, consider the false positives you would see from:<div><br></div><div style>* A mis-behaving client.</div><div style>
* A large pool of clients behind a single ( NAT ) IP.</div><div style>* A large pool of unique clients, depending on how large your client base is.</div><div style><br></div><div style>How were you thinking of rate limiting?</div>
<div style><br></div><div style><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Apr 3, 2013 at 7:29 AM, <span dir="ltr"><<a href="mailto:WBrown@e1b.org" target="_blank">WBrown@e1b.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I noticed that queries for <a href="http://isc.org" target="_blank">isc.org</a> would come from numerous IP addresses<br>
but the source port would be consistent for long period of times. A<br>
little jiggery with daemon.log and I got the report below where first<br>
column is the number of occurrences of the source port (# separator<br>
changed to space for sort/uniq field definition). The port number is the<br>
only field I used in this, IP address below is just one of many hits for<br>
that port.<br>
<br>
Commands used were:<br>
<br>
sed -e s/#/\ / /var/log/daemon.log |sort -k 8 > ~/sorted<br>
uniq -c -d -f 8 ~/sorted |sort -n -r -k 1 |more<br>
<br>
Does it make sense to look at source port for any level of rate limiting?<br>
<br>
4085406 Apr 1 00:00:00 ns3 named[3407]: client 178.32.36.37 25345<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
113613 Apr 1 00:06:28 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 26451<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
37086 Apr 2 00:10:44 ns3 named[3407]: client 108.59.9.97 49940<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
6388 Apr 1 17:22:07 ns3 named[3407]: client 91.102.165.40 41819<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
5703 Apr 3 01:28:24 ns3 named[3407]: client 178.32.62.37 57335<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
4513 Apr 3 01:41:15 ns3 named[3407]: client 69.60.109.62 32743<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
4009 Apr 1 13:29:08 ns3 named[3407]: client 85.180.66.207 28943<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
3410 Apr 1 21:18:15 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 38299<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
3225 Apr 3 02:07:16 ns3 named[3407]: client 46.105.191.93 31198<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
2505 Apr 1 00:01:18 ns3 named[3407]: limit responses to<br>
<a href="http://216.226.125.0/24" target="_blank">216.226.125.0/24</a><br>
2504 Apr 1 00:01:06 ns3 named[3407]: stop limiting error responses to<br>
<a href="http://216.226.125.0/24" target="_blank">216.226.125.0/24</a><br>
2280 Mar 31 22:55:43 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 18406<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
2231 Apr 2 00:10:44 ns3 named[3407]: client 108.59.9.97 53501<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
2178 Apr 1 15:49:56 ns3 named[3407]: client 178.32.244.171 45813<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1845 Apr 2 18:20:23 ns3 named[3407]: client 62.75.246.181 14716<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1704 Mar 31 15:20:48 ns3 named[3407]: client 176.31.24.240 35853<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1325 Apr 1 14:27:54 ns3 named[3407]: client 37.43.129.10 14898<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1049 Apr 1 18:45:47 ns3 named[3407]: client 178.32.62.37 34424<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1043 Apr 1 20:40:06 ns3 named[3407]: client <a href="tel:5.135.134.141" value="+15135134141">5.135.134.141</a> 48733<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1033 Apr 1 13:29:08 ns3 named[3407]: client 85.180.66.207 43639<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
1022 Apr 1 19:02:39 ns3 named[3407]: client 208.98.0.3 61182<br>
(<a href="http://isc.org" target="_blank">isc.org</a>): query (cache) '<a href="http://isc.org/ANY/IN" target="_blank">isc.org/ANY/IN</a>' denied<br>
<br>
These are all records where count was above 1000.<br>
<br>
--<br>
<br>
William Brown<br>
Core Hosted Application Technical Team and Messaging Team<br>
Technology Services, WNYRIC, Erie 1 BOCES<br>
<a href="tel:%28716%29%20821-7285" value="+17168217285">(716) 821-7285</a><br>
<br>
<br>
<br>
<br>
Confidentiality Notice:<br>
This electronic message and any attachments may contain confidential or<br>
privileged information, and is intended only for the individual or entity<br>
identified above as the addressee. If you are not the addressee (or the<br>
employee or agent responsible to deliver it to the addressee), or if this<br>
message has been addressed to you in error, you are hereby notified that<br>
you may not copy, forward, disclose or use any part of this message or any<br>
attachments. Please notify the sender immediately by return e-mail or<br>
telephone and delete this message from your system.<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>
dns-jobs</a> mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Augie Schwer - Augie@Schwer.us - <a href="http://schwer.us" target="_blank">http://schwer.us</a><br>
</div>