Member Avatar for bbailey

I've been getting a large number (150,000/day) of DNS quereis in the form of A record searches to IP addresses (i.e. 192.1.2.3.domain.org).

My best guess is this should be considered a UDP Flood Attack. Can anyone confirm if this is accurate or not?

  • 2 Contributors
  • 3 Replies
  • 130 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by sknake

Dani AI

Generated

This pattern is more specific than a generic "UDP flood." Given ’s description, it most closely matches a random-subdomain DNS query flood (sometimes called "DNS water torture"): many unique A‑record queries under your zone force authoritative lookups for names that cannot be cached, driving CPU and query load on name servers. That is different from classic DNS amplification/reflection attacks (see Cloudflare for the distinction).

Practical confirmation steps (capture and triage):

sudo tcpdump -n -s 0 -w dns_attack.pcap udp port 53
tshark -nr dns_attack.pcap -Y "dns.qry.name contains \"yourdomain.tld\"" -T fields -e ip.src -e udp.srcport -e dns.qry.name | \
  sort | uniq -c | sort -nr | head

Look for: very high cardinality of distinct query names, query rates per second, whether source IPs are many or few, whether source UDP ports and DNS transaction IDs are truly random (suggesting spoofing), and whether queries set the RD bit or include EDNS options.

Mitigations to try quickly:

  • Enable Response Rate Limiting (RRL) on your authoritative server (BIND/unbound/PowerDNS all have mitigations).
  • Rate‑limit at the firewall for port 53 (example iptables hashlimit), but whitelist known recursive resolvers to avoid breaking service.
  • Ask your upstream/ISP for source filtering or BGP Remote Triggered Black Hole (RTBH) / flow scrubbing if the volume is large.
  • Ask upstream about ingress filtering (BCP38/RFC2827) to block spoofed sources.

Collect a short pcap (anonymize if needed) and share it when possible; as suggested, the pcap will make it easy to confirm spoofing vs many real clients and to tune countermeasures.

Cloudflare: DNS amplification and related DDoS types
BCP 38 / RFC 2827 (ingress filtering)

Recommended Answers

All 3 Replies

Member Avatar for sknake

Are you getting the requests over UDP or TCP? DNS uses both protocols.. Upload your network traffic capture for the DNS, its really hard to say without taking a look. You can use wireshark or tcpdump to generate a pcap file.

Member Avatar for bbailey

Are you getting the requests over UDP or TCP? DNS uses both protocols.. Upload your network traffic capture for the DNS, its really hard to say without taking a look. You can use wireshark or tcpdump to generate a pcap file.

sknake,

It's all UDP queries. The info block of Wireshark comes across as :
Standard query A 123.45.67.89.domain.org

With the IP address always being a random IP address and the domain being our domain.

I can try and get a copy of the PCAP file sent to me, but probably not till after New Years.

I'm trying to get a feel of accuracy if I report that 150,000 DNS queries that are malformed should be considered a Denial of Service attack and if its appropriate to list it as a UDP flood attack.

Member Avatar for sknake

There is a lot more information in wireshark than just the DNS query so it would be helpful to have the pcap logs to analyze the traffic. With UDP you can "spoof" the sender since it is a stateless protocol and the advantage of doing that is you can force the server to send a response out eating up more bandwidth than just hammering it with queries. It sounds like a denial of service attack and is a UDP attack as well. There are many forms of UDP attacks, DNS attacks being one. I'm not sure the classification of what kind of attack it is matters as much as getting the traffic blocked. You can likely adjust settings on your router or DNS server to minimize the effects of the attack until you can contact your upstream provider and have them trace the traffic back and block it.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.