Re: server sending syn to port 53

Oscar Ricardo Silva wrote:
> We were notified that one of our servers running dnscache were
> generating a syn attack on a target dns servers.  Sure enough, when we
> looked we saw that we were sending SYN packets to these servers.  I'm
> not saying it's dnscache causing this but the pattern appears to be that
> we send a query and then right afterwards, several SYN packets to the
> same server.

A full packet dump and output of lsof or sockstat or the equivalent
might be needed in order to comment meaningfully on this.

If the response would be over 512 bytes then the server would issue
and error and a TCP connection (with SYN set, of course) would be
appropriate.  Why are you calling this an "attack" ??

- M