DDoS attack

[patt1293]

Oct 21 05:18:15 host named[789]: unexpected RCODE (SERVFAIL) resolving 'fibre.cablebahamas.com/AAAA/IN': 198.6.1.82#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (SERVFAIL) resolving 'coax.cablebahamas.com/AAAA/IN': 198.6.1.82#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '90.0.206.24.in-addr.arpa/PTR/IN': 208.246.140.130#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '90.0.206.24.in-addr.arpa/PTR/IN': 208.246.140.129#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 194.170.1.6#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '90.0.206.24.in-addr.arpa/PTR/IN': 208.246.140.130#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 194.170.1.99#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '90.0.206.24.in-addr.arpa/PTR/IN': 208.246.140.129#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '100.167.117.123.in-addr.arpa/PTR/IN': 202.31.190.1#53
Oct 21 05:18:15 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 194.170.1.7#53
Oct 21 05:18:16 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 195.229.237.52#53
Oct 21 05:18:16 host named[789]: lame server resolving '100.167.117.123.in-addr.arpa' (in '117.123.in-addr.arpa'?): 203.248.246.220#53
Oct 21 05:18:16 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 195.229.237.52#53
Oct 21 05:18:16 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 194.170.1.7#53
Oct 21 05:18:16 host named[789]: unexpected RCODE (REFUSED) resolving '100.167.117.123.in-addr.arpa/PTR/IN': 203.83.159.1#53
Oct 21 05:18:16 host named[789]: lame server resolving '113.91.44.72.in-addr.arpa' (in '91.44.72.in-addr.arpa'?): 72.44.84.7#53
Oct 21 05:18:16 host named[789]: lame server resolving '113.91.44.72.in-addr.arpa' (in '91.44.72.in-addr.arpa'?): 78.129.177.253#53
Oct 21 05:18:16 host named[789]: unexpected RCODE (REFUSED) resolving '216.236.229.195.in-addr.arpa/PTR/IN': 194.170.1.99#53
Oct 21 05:18:16 host named[789]: lame server resolving '113.91.44.72.in-addr.arpa' (in '91.44.72.in-addr.arpa'?): 208.100.59.254#53

are those unexpected RCODE (SERVFAIL)and unexpected RCODE (REFUSED)
a sign of a DDoS attack
There are about 1000 of them in the span of 20 seconds


I restart the server VIA remote reboot and about 5-6 seconds after that the server becomes unreachable.

I have asked a couple people and they say it could very well be one.

I need a good answer not just a "that sucks"


Thanks

patt1293 Reviewed by patt1293 on 21st Oct 2009. DDoS attack are those unexpected RCODE (SERVFAIL)and unexpected RCODE (REFUSED) a sign of a DDoS attack There are about 1000 of them in the span of 20 seconds I restart the server VIA remote reboot and about 5-6 seconds after that the server becomes unreachable. I have asked a couple people and they say it could very well be one. I need a good answer not just a "that sucks" Rating: 5

[jayfella]

no. at a glance i would say its an incorrectly configured DNS.

[patt1293]

you should take a look at this pic then



DDoS locally?? LOL

[Dell23]

no ddos to me btw DDos and Dos is two different thing most of them closed