Question about DNS blackhole'ing

OK, I have a question, it's not exactly specific to DLZ usage (although a solution may come from the fact that I have DLZ installed).  

I've got a BIND 9.4 server with DLZ (mysql) running on my server, and everything is great. This runs on a debian etch server, so I just have the debian packages installed.

However, about once a week or so, my DNS server gets pounded by some foreign (russian, I believe) server with a ton of port 53 DNS traffic. It's all invalid traffic, for lame servers that I've never had, etc. The problem is, the traffic continues unabated for sometimes days on end, constant, which drives up my bandwidth costs.  I have on several occasions in the past asked my data center host to tell me from the router logs where all the traffic is coming from, and they've been able to show me which IP it is that is pounding my DNS server. I then immediately add that IP to my blackhole list in the BIND configuration, and the traffic completely drops off.

Of all the various services I have on my box, DNS seems to be the only one I've not found a good solution to how to have server logs which tell me what is being accessed, and more specifically, WHO is doing it (similar to mail or apache logs).

What I would like is a way to have all the DNS connections logged in some way, so that I could (without bothering my data center host) find out which IP is hitting my server. Another idea (even better) would be if BIND had some way to automatically throttle or black-hole an IP if it has too many DNS hits within a certain small amount of time. I know mail servers have this, and also I think apache. But I've never found anything like this for BIND.

Does anyone have any ideas on what I could do? Perhaps I could build into my mysql DLZ queries some sort of mysql-based logging of the requesting IP?  I dunno, but I just REALLY need to find a way to solve this. Any help would be greatly appreciated.

--Kyle Simpson

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H

_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers