Question About max-clients-per-query

[Lightner, Jeff]

Not an answer to your basic question but I did want to mention that on most UNIX/Linux terminal sessions you can hit "Ctrl-s" to stop scrolling and "Ctrl-q" to resume it.





-----Original Message-----
From: bind-users-bounces+jlightner=water.com at lists.isc.org [mailto:bind-users-bounces+jlightner=water.com at lists.isc.org] On Behalf Of Alan Shackelford
Sent: Friday, November 18, 2011 10:32 AM
To: bind-users at lists.isc.org
Subject: Question About max-clients-per-query

I had a situation a couple of days ago where a compromised machine in the DMZ portion of my network began sending an incredible number of queries to a couple of the primary internal DNS servers. The traffic was so intense that legitimate queries were unable to get through, or the customer timed out before the response came back. It took me a while to diagnose, because tailing the logs with querylog on was not possible. The data were coming too fast for my terminal to display them. Only after several Cntl-C commands was I able to escape from the tail, and a portion of the logs was displayed. Only queries from the compromised machine were visible. Nothing else got through during that time period. My customers and bosses are naturally furious.

So is it possible to limit the number of queries for one name from one client, or even better, limit the number in a certain time, or the number of queries "in a row" from one client. If not we are going to have to be creative with some iptables or firewall rules.

Thanks for any help you can lend.

Alan V. Shackelford                   Sr. Systems Software Engineer
The Johns Hopkins University and Johns Hopkins Medical Institutions
Baltimore, Maryland USA       410-735-4773        ashackel at jhmi.edu






Athena(r), Created for the Cause(tm)
Making a Difference in the Fight Against Breast Cancer

---------------------------------
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.
----------------------------------