Re: server sending syn to port 53

Michael Sierchio wrote:
> Oscar Ricardo Silva wrote:
>> We were notified that one of our servers running dnscache were
>> generating a syn attack on a target dns servers.  Sure enough, when we
>> looked we saw that we were sending SYN packets to these servers.  I'm
>> not saying it's dnscache causing this but the pattern appears to be that
>> we send a query and then right afterwards, several SYN packets to the
>> same server.
> 
> A full packet dump and output of lsof or sockstat or the equivalent
> might be needed in order to comment meaningfully on this.
> 
> If the response would be over 512 bytes then the server would issue
> and error and a TCP connection (with SYN set, of course) would be
> appropriate.  Why are you calling this an "attack" ??
> 
> - M


Oh sorry, I'm not calling it an attack, I was just using the wording of 
the person who contacted me about this behavior.  I've done some packet 
dumps but haven't finished going through them to post.