Named requests filling up T1

[Matt Emmerton]

> Ugh...it's always something....
>
> The T1 here is getting blasted by named requests, any suggestions would
> be appreciated... I turned on debugging and got the following, lots of
> them...so many that we're getting 30-50% packet loss across the T1:
>
> 16-Jan-2006 18:01:35.795 client @0x87d4800: udprecv
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: UDP request
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: using view '_default'
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: request is not signed
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: recursion available
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: query
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: query (cache)
> 'v.tn.co.za/ANY/IN' approved
> 16-Jan-2006 18:01:35.795 client 64.18.133.103#5550: send
> 16-Jan-2006 18:01:35.796 client 64.18.133.103#5550: sendto
> 16-Jan-2006 18:01:35.796 client 64.18.133.103#5550: senddone
> 16-Jan-2006 18:01:35.796 client 64.18.133.103#5550: next
> 16-Jan-2006 18:01:35.796 client 64.18.133.103#5550: endrequest
>
> Any suggestion on what it might be and how I might stop it?

Looks like someone is spamming your DNS server with queries.

Two questions:
1) Is v.tn.co.za a domain that you are authorative for?
2) Are you an ISP and/or is client 64.18.133.103 authorized to use your DNS
server?

If the answer to 1) is NO, then there's no reason for these queries to be
directed to your DNS server from the Internet.
If the answer to 2) is NO, then there's no reason for these queries to be
directed to your DNS server from the Internet.

Source IP filtering is likely your best option, although it doesn't help
with your T1 saturation, although it would give whoever is blasting these
queries a clue.

--
Matt Emmerton