Re: server sending syn to port 53

Alex Pennace wrote:
> On Thu, Apr 16, 2009 at 05:23:50PM -0500, Oscar Ricardo Silva wrote:
>> We were notified that one of our servers running dnscache were 
>> generating a syn attack on a target dns servers.  Sure enough, when we 
>> looked we saw that we were sending SYN packets to these servers.  I'm 
>> not saying it's dnscache causing this but the pattern appears to be that 
>> we send a query and then right afterwards, several SYN packets to the 
>> same server.
> 
> More information is needed. Please provide the relevant logs.
> 
> Chances are, dnscache is trying to open a TCP connection to their
> authoritative DNS servers because they are sending a response that is
> too large to be sent via UDP. If that is the case, then things are
> working as designed -- although it seems silly to publish large DNS
> responses, then complain about TCP connections afterwords.


In this case, it was the suggestion that the answers being received were 
too large that got me looking a little closer.  Sure enough, my cache 
was getting a bad answer and dnscache was then trying a TCP query. 
Since dnscache sends queries to all the authoritative servers, an answer 
was received and passed on to the client so it didn't look like a 
complete failure.

I will now pass on my findings to the original reporter letting them 
know their server is busted.  I appreciate all the replies.


O