5

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 in header and DNS response the one with the flag set to 1.

  1. Are the jumps in responses with the width of about 30 minutes resemble some kind of attack?
  2. What about jumps in queries?
  3. Why is there a large and constant difference between the queries and responses for long period of time?

enter image description here

EDIT: Above graph shows DNS over UDP. Here is the SYNs/sec graph:

enter image description here

EDIT: This is a part of traffic passing a country and internet.

Improve this question
8
  • 1
    Could you provide a bit more information on your network setup and what are most used network applications that might have caused these failed DNS queries? I'm not really sure what we're looking at here, save for those requests/sec do seem rather high. How big is your network? The discrepancies between DNS requests and responses might be actually normal in your case, if you're using a lot of network clients that hit the DNS black hole for some reason. Your graph looks consistent with a lot of P2P traffic to me, and I wouldn't call it a SYN-Flood just yet without knowing more.
    – TildalWave
    Commented Feb 21, 2013 at 10:40
  • These features are from the traffic between a country! and the internet. So it contains all types of applications. I updated my question with the graph of SYNs. I can't see any correlation between SYN and DNS graphs.
    – Yasser
    Commented Feb 21, 2013 at 16:43
  • Does this mean it's TCP and not UDP? Perhaps there is a resolver bug in some client that messes up large queries (where UDP can't be used).
    – makerofthings7
    Commented Feb 21, 2013 at 17:10
  • @Yasser MZadeh - Could you please update your question to include all the relevant information then? I don't see it ever being answered properly when it's rather unclear what the question was in the first place. You asked if those could be traces of DNS attacks, and I've commented that based on what information you've provided us with, it's not necessarily so. You've only now mentioned the scale of your network operations, and even this only partially as a country can be anything from Vatican City to China. I don't see how we could provide you with anything conclusive based on a graph or two.
    – TildalWave
    Commented Feb 21, 2013 at 17:20
  • What extra information are needed? I have the graph of other L3/L4 header features, such as nPkts/sec, TCP flags. I updated the question.
    – Yasser
    Commented Feb 21, 2013 at 18:00

2 Answers 2

Reset to default
1

I'm hesitant to post an answer simply because of the lack of data provided however simply based on the graphs, I would assume that this is due to someone using this server for DNS tunneling. David Bianco has written up an article on DNS-tunneling detection by analyzing the network statistics. He says that you can detect DNS-tunneling by seeing a very lopsided request/response of DNS queries which you seem to have.

A traffic-analysis approach to detecting DNS tunnels

Improve this answer
1

If you are interested in getting any sort of useful answer here, packet captures, query logs or netflow records are a must. At the most basic level, we need to establish the 5-tuple relationships to figure out exactly what communications are happening. From there, one might look to dig deeper based on query logs to figure out what is possibly making the requests.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .