🚀 go-pugleaf

Ray Abbitt wrote:
> 
> In article <3A9D3A6B.F5CC6176@mynetwatchman.com>,
> Lawrence Baldwin  <baldwinlSPAMMENOT@mynetwatchman.com> wrote:
> >
> >Our false-positive rate is remarkably low...in the last 30 days we have
> >only had ONE incident where the source provider indicated that the
> >attack was really their load-balancing servers sending DNS queries to
> >determine RTT and best route.
> >
> One question on that. Do you really consider sending repeated DNS queries
> to systems that are not listed as DNS servers (and in fact do not run
> DNS servers) anything other than abusive? Maybe the load-balancing software
> is broken, but once they know that, shouldn't something be done about it?
> (And was Microsoft the guilty party? I'm still getting large numbers of
> attempts [30000-40000 a month] on port 53 from various Microsoft addresses.)
> 
I think the F5 load balancing issue needs more investigation...my agents
also are continuing to report port 53 scans from usatoday even days
after NOT surfing there.  Now they are blocking 53, so I'd expect some
amount of re-tries...but retrying DAYS later...I agree, something is
wrong.

lb.

-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?