LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-27-2009, 02:11 PM   #1
Quest101
LQ Newbie
 
Registered: Nov 2004
Posts: 27

Rep: Reputation: 15
Creating a DNS "dead Zone"


I have a situation where a dns client is bombarding my dns server with dummy requests to the point that it seems to be running up my CPU to almost 100% utilization. Due to limitations on the client I am unable to stop the requests from being generated right now.

Is there a way for me to point these dummy requests to a NULL address ( if there is anything like that ) that would prevent further requests ?? or any other solution you would recommend.

The requests usually have the name <whatever>.xyz.com ( so the xyz.com is common to all the dummy requests )

Any help would be appreciated... thanks
 
Old 04-27-2009, 03:14 PM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,831
Blog Entries: 15

Rep: Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669
In your named.conf:

in options add:
blackhole { blackhats; };

Create and acl called blackhats:
acl "blackhats" {
ip1;ip2;ip3
};

Where you put in the IP addresses of the offending site.

I don't know of a way to do it by domain name as you requested. However, chances are a lot of what you're seeing is all coming from a common network so you can specify that network with CIDR.
 
Old 04-27-2009, 04:13 PM   #3
CarLost
Member
 
Registered: Jun 2004
Location: Sentado en mi trasero en Chile
Distribution: ArchLinux
Posts: 47

Rep: Reputation: 16
Also you can manage with iptables and module "recent" it is very cool and scalable.-

You can accept just a few request from any IP for a short time (starting at 60 seconds) if the client reach this few request he will REJECT or DROP until he stop for a 60 seconds. You can add another rule multiplied by 10 the request numbers and drop for an hour.... ETC

Think about it
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
"creating symbolic link" "operation not permitted" wheni Linux - Newbie 3 05-08-2011 01:36 AM
"ext3_new_block: Allocating block in system zone" from RAID5 device tan_ce Linux - Server 3 11-25-2008 06:37 AM
Why my "multiple desktop zone" is lost on controll pannel? ArthurHuang Linux - Desktop 8 01-21-2008 10:24 AM
DNS error : "localhost.zone file not found" rajat Linux - Server 2 04-25-2007 11:26 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:57 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration