<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sir Izake,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Any network troubleshooting starts with finding out what is being placed on the wire. In your particular example it sounds like you need to validate if this
Cent box is seeing a SYN flood. You do this by using tcpdump.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Assuming you only have one ethernet adapter (which by extension rules out its use as a proxy or a bridge) you would issue the following command:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">sudo tcpdump 'tcp[13] & 2!=0'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">You should see something like this start showing up:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">10:27:43.627614 IP 197.2.11.116.33465 > 10.41.32.21.domain: Flags [S], seq 166424657, win 8192, options [mss 1400,nop,wscale 8,nop,nop,sackOK], length 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Source IP is on the left of the > and destination IP is on the right. From there you can begin to make informed decisions about your next steps.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Finally, if you have never used tcpdump here is a great resource to get started with on how to play around with the different commands:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="https://danielmiessler.com/study/tcpdump/">https://danielmiessler.com/study/tcpdump/</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Good hunting!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">John<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> bind-users [mailto:bind-users-bounces@lists.isc.org]
<b>On Behalf Of </b>sir izake<br>
<b>Sent:</b> Saturday, April 11, 2020 8:42 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Bind 9 not responding to queries<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Support<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have installed BIND 9.11.4-P2-RedHat-9.11.4-26.P2.el8 on CentOS Linux release 8.1.1911.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have configured bind as a recursive server for my network. At specific times of day bind fails to respond to queries even though service is shown to run (configured to respond to my network IPs, this works fine till this time when service
fails to answer queries) <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have looked through the logs and found below ;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Apr 10 20:12:43 ##### automatic empty zone: B.E.F.IP6.ARPA<br>
Apr 10 20:12:43 ##### named[25445]: automatic empty zone: <a href="http://8.B.D.0.1.0.0.2.IP6.AR">
8.B.D.0.1.0.0.2.IP6.AR</a>><br>
Apr 10 20:12:43 ##### named[25445]: automatic empty zone: EMPTY.AS112.ARPA<br>
Apr 10 20:12:43 ##### named[25445]: automatic empty zone: HOME.ARPA<br>
Apr 10 20:12:43 ##### named[25445]: none:103: 'max-cache-size 90%' - setting to ><br>
Apr 10 20:12:44 # ##### named[25445]: configuring command channel from '/etc/rndc.><br>
Apr 10 20:12:44 ##### named[25445]: command channel listening on 127.0.0.1#953<br>
Apr 10 20:12:44 ##### named[25445]: configuring command channel from '/etc/rndc.><br>
Apr 10 20:12:44 ##### named[25445]: command channel listening on ::1#953<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">others <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Apr 11 22:38:01 ##### systemd[1]: Started Session 29 of user ABC.<br>
Apr 11 22:38:04 ##### dbus-daemon[13352]: [system] Activating via systemd: service name='net.reactivated.Fprint' unit='fprintd.service' requested by ':1.24116' (uid=0 pid=5364 comm="su - " label="unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023")<br>
Apr 11 22:38:04 ##### systemd[1]: Starting Fingerprint Authentication Daemon...<br>
Apr 11 22:38:04 ##### dbus-daemon[13352]: [system] Successfully activated service 'net.reactivated.Fprint'<br>
Apr 11 22:38:04 ##### systemd[1]: Started Fingerprint Authentication Daemon.<br>
Apr 11 22:38:09 ##### kernel: TCP: request_sock_TCP: Possible SYN flooding on port 53. Sending cookies. Check SNMP counters.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Could log point to DDoS attack ( how do i mitigate) <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have tried to update bind but it looks like its the stable for Centos 8<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Please advise what can be done to prevent the intermittent failures<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Isaac <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>