Re: [cobalt-users] Blocking massive DNS queries

[Larry Smith <lesmith@xxxxxxxxx>]

On Saturday 24 April 2004 13:28, aljuhani wrote:
>
> Well they recommend that I should turn off the DNS server!!
> But anyway I posted the list of IPs and they contacted abuse ...
> my nick is jstone in the session here below of irc.ev1.net -> ev1servers
>
> <jstone> yes DNS queries port 53
> <Resolution_Black> do you have dns running and being in activly in use
> <Resolution_Black> if not turn it off
> <Resolution_Black> that'll reduce the effects of the attack
> <jstone> then my webserver will die
> <EV1-Todd> jstone, what kind of bandwidth usage are you talking about?
>

No, actually the comment was "If you are not actually "running" dns for your 
site(s) then turn it off" - the "if not" above has significant relevance.

Not standing up for anyone, but your comment definitely gives the "wrong" 
impression of their answer...

I deliberately do _not_ run DNS on any of my cobalt boxes partly for this very 
reason.  They are hosting boxes, I let my DNS servers do dns since that is 
their function in life (course it is also nice to have separate dns servers 
to be able to do this and it keeps the load down on the cobalts)...

-- 
Larry Smith
SysAd ECSIS.NET
sysad@xxxxxxxxx