DDoS - mpecllc.com - dns to web hits
"David McCall" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
This morning I decided to look at what IP's were hitting our dns servers
and whether or not they were already on the untrusted list. The snapshot
from 1/6 of our dns server pool was for about 1 hour between 6am and 7am PST.
Thus far the untrusted IP table is 47,853 IP's (being blocked from the web server by SQUID).
During the hour test on 1/6 of our dns servers there were 697 queries for the domain mpecllc.com
Out of those queries there were only 68 pre-existing entries in the untrusted IP table.
./checkdns | wc -l
68
tmp/mpecllc.com # wc -l dnsHits
697 dnsHits
tmp/mpecllc.com # wc -l untrusted
47853 untrusted
I suppose I'm trying to make some meaning out of all the data that might be important to
this event.
If anyone has any other stats they would like me to collect on this let me know.
David C.McCall
UNIX Administrator
===================
EschelonTelecom
[email protected]
[email protected]
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions