Discuss mailing list

[Alex Hanselka <alex AT opennicproject.org>]

I highly suggest running ddos.pl if you do not already. It almost 
always catches these and reduces their damage to minimal. Also, iptables 
will only block the reply which is usually the largest part anyway. The 
request bandwidth will always be used unless it is blocked somewhere 
upstream.

On 2012-10-17 16:01, Martin C wrote:
> > day and noticed one IP doing a lot of lookups for the same domain 
> > over
> > and over again (isc.org).
> >
> > I thought nothing of it until
>
> Hehe, I should clarify that I did think something of it, but 
> fortunately
> I have never experienced a DoS directly myself, so in the back of my
> mind I thought the logs hinted at it, and I thought to myself that I
> would wait a bit to see if it continued.
>
> It did, so I got my old friend iptables to take care of it. A fourth 
> IP
> decided to make trouble soon after, 202.83.95.228 which I believe is
> from a local range, so I couldn't understand how it could be doing 
> the
> same things the other IPs were, but there it was.