Re: We are experiencing a DDoS attacking one ofourdomains - mpecllc.com

Merton Campbell Crockett <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]>
On Tue, 18 Jan 2005, Maxime Ducharme wrote:

> DNS relies on UDP tough, it could be spoofed packets.

One assumes and expects that UDP will be used for DNS queries.  However, 
during the last year, I've noticed a substantial increase in the use of 
TCP for DNS queries.  The systems using TCP tend to be Windows XP systems.

This may be a side-effect of deploying Windows Active Directory in a 
large, geographically dispersed organisation where the Windows weanies 
insist on running Microsoft DNS on every domain controller.  With 200+ 
domain controllers, there's a little problem with the size of the 
authority and additional sections of the response. :(

Merton Campbell Crockett


-- 
BEGIN:				vcard
VERSION:			3.0
FN:				Merton Campbell Crockett
ORG:				General Dynamics Advanced Information Systems;
				Intelligence and Exploitation Systems
N:				Crockett;Merton;Campbell
EMAIL;TYPE=internet:		[email protected]
TEL;TYPE=work,voice,msg,pref:	+1(805)497-5045
TEL;TYPE=work,fax:		+1(805)497-5050
TEL;TYPE=cell,voice,msg:	+1(805)377-6762
END:				vcard
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.