<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.9">
</HEAD>
<BODY>
On Tue, 2009-01-27 at 07:45, Tony Toews [MVP] wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#8b6914"><I>Folks
Warning - I know just enough about Bind to be dangerous. Which is why I'm asking.
I just noticed that our small scale Bind server as a lot of the following lines.
26-Jan-2009 14:28:24.004 client 76.9.16.171#23101: query: . IN NS +
26-Jan-2009 14:28:58.254 client 63.217.28.226#28035: query: . IN NS +
26-Jan-2009 14:29:00.691 client 63.217.28.226#35549: query: . IN NS +
26-Jan-2009 14:29:26.332 client 76.9.16.171#19817: query: . IN NS +
As far as I can tell from the same 5 or 20 IP addresses. I haven't seen these lines
before.
</I></FONT></PRE>
</BLOCKQUOTE>
<BR>
This is not your config, so long as you are not answering thats fine. It's a forged request asking you to participate in a DDoS thats been going on since last Wedensday,<BR>
it's best if you firewall off your replies to those IP's so you don't participate in harming the innocent victims.
<PRE></PRE>
</BODY>
</HTML>