Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 04-27-2009, 02:11 PM   #1
LQ Newbie
Registered: Nov 2004
Posts: 27

Rep: Reputation: 15
Creating a DNS "dead Zone"

I have a situation where a dns client is bombarding my dns server with dummy requests to the point that it seems to be running up my CPU to almost 100% utilization. Due to limitations on the client I am unable to stop the requests from being generated right now.

Is there a way for me to point these dummy requests to a NULL address ( if there is anything like that ) that would prevent further requests ?? or any other solution you would recommend.

The requests usually have the name <whatever> ( so the is common to all the dummy requests )

Any help would be appreciated... thanks
Old 04-27-2009, 03:14 PM   #2
LQ Guru
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,949
Blog Entries: 14

Rep: Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163
In your named.conf:

in options add:
blackhole { blackhats; };

Create and acl called blackhats:
acl "blackhats" {

Where you put in the IP addresses of the offending site.

I don't know of a way to do it by domain name as you requested. However, chances are a lot of what you're seeing is all coming from a common network so you can specify that network with CIDR.
Old 04-27-2009, 04:13 PM   #3
Registered: Jun 2004
Location: Sentado en mi trasero en Chile
Distribution: ArchLinux
Posts: 47

Rep: Reputation: 16
Also you can manage with iptables and module "recent" it is very cool and scalable.-

You can accept just a few request from any IP for a short time (starting at 60 seconds) if the client reach this few request he will REJECT or DROP until he stop for a 60 seconds. You can add another rule multiplied by 10 the request numbers and drop for an hour.... ETC

Think about it


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
"creating symbolic link" "operation not permitted" wheni Linux - Newbie 3 05-08-2011 01:36 AM
"ext3_new_block: Allocating block in system zone" from RAID5 device tan_ce Linux - Server 3 11-25-2008 06:37 AM
Why my "multiple desktop zone" is lost on controll pannel? ArthurHuang Linux - Desktop 8 01-21-2008 10:24 AM
DNS error : " file not found" rajat Linux - Server 2 04-25-2007 11:26 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:29 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration