Security Incidents mailing list archives

Help in flood


From: Mauro Marazzi <mauro.marazzi () netsystem com>
Date: 29 Sep 2003 15:43:15 -0000



Hello .
We have had a flood described below on a red hat 7.3 system with bind 9 (is a Dns server). Bandwidth consumption about 
30Mbps. What kind of attack is? And how to prevent it?

Regards,

Mauro Marazzi

11:25:00.017182 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017185 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017186 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017187 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017202 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017216 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017218 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017231 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017233 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017247 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017262 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017263 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017277 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017278 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017292 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017307 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)
11:25:00.017308 66.185.161.58.54407 > 212.31.242.100.53:  12337 op6$ [b2&3=0x3233] [13879a] [13365q] [14393n] 
[16706au][|domain] (DF)

---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: