Re: DNS SPOOF query response with ttl: 1 min. and no authority

[John Sage <jsage () finchhaven com>]

James:

James wrote:

> > Note that this is a DNS Time-To-Live, regarding the length of time that
> > the Resource Record should be cached by the client...
> >
> > ...not the more commonly seen IP TTL, which relates to the number of
> > hops a packet gets before it's smooshed.
>
> Cool, that clears one thing up. Here is one I got yesterday.
>
> DNS SPOOF query response with ttl: 1 min. and no authority [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 12/14-17:01:17.608704 216.2.192.32:53 -> xxx.xxx.xxx.xxx:53
> UDP TTL:240 TOS:0x0 ID:47887 IpLen:20 DgmLen:77 DF
>
> xxx.xxx.xxx.xxx is my NS, so my NS queried them and they returned a dns ttl
> of 60 (secs)
> attempting to override the standard ~12 hrs refresh of the dns cache ?


Yup. That's my understanding..


> "No authority" would indicate the auth NS for "them" could not respond ?
> This could indicate
> the auth NS was downed by a DoS or other means, so it could be spoofed ?


Well, the nameserver *was* responding, it just had no Authority RR's, 
and it's sending back a weird TTL..

"No Authority" means that the nameserver queried 
(tully.cablevision.com?) did not return any "Authoritative Resource 
Records" -- so it is not an authoritative source for the information you 
(may..) have requested.

/* grins as he finds himself becoming an expert on DNS */

For a giggle, here's what I get when I try to dig something from 
216.2.192.32:

[toot@greatwall /var/log/snort]# dig @tully.cablevision.com cablevision.com

; <<>> DiG 8.2 <<>> @tully.cablevision.com cablevision.com
; (1 server found)
;; res options: init recurs defnam dnsrch
;; res_nsend to server tully.cablevision.com  216.2.192.32: Connection
timed out


So dig thinks it finds a nameserver at tully.cablevision.com, but I get 
nothing back..

I wouldn't say that tells us much about whether it's been DDoS'ed or 
whatever.

What sort of response were you expecting?

What prompted the query to 216.blah.blah in the first place?



- John


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users