Discuss mailing list

[Dean Gardiner <fuzeman91 AT gmail.com>]

For me I've had all incoming traffic on port 53 blocked since the start of the first DDoS but the incoming traffic still consumes my ISP connection which I can't do anything about.

On Oct 18, 2012 10:10 AM, "Alex Hanselka" <alex AT opennicproject.org> wrote:

I highly suggest running ddos.pl if you do not already. It almost always catches these and reduces their damage to minimal. Also, iptables will only block the reply which is usually the largest part anyway. The request bandwidth will always be used unless it is blocked somewhere upstream.

On 2012-10-17 16:01, Martin C wrote:

day and noticed one IP doing a lot of lookups for the same domain over
and over again (isc.org).

I thought nothing of it until

Hehe, I should clarify that I did think something of it, but fortunately
I have never experienced a DoS directly myself, so in the back of my
mind I thought the logs hinted at it, and I thought to myself that I
would wait a bit to see if it continued.

It did, so I got my old friend iptables to take care of it. A fourth IP
decided to make trouble soon after, 202.83.95.228 which I believe is
from a local range, so I couldn't understand how it could be doing the
same things the other IPs were, but there it was.

--------
You are a member of the OpenNIC Discuss list. You may unsubscribe by emailing discuss-unsubscribe@lists.opennicproject.org