3

My Symantec end point traffic logs keep showing that inbound UDP traffic from the DNS server is blocked. This happens every few minutes. Is it a potential attack?

closed as unclear what you're asking by Tobi Nary, AJ Henderson, schroeder Oct 24 '17 at 16:26

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Can you resolve domain names? I guess you would have said if not, but DNS answer are "incoming UDP traffic from DNS server", can you figure out what the endpoint think is "DNS server" (likely is your router, so incoming traffic from your router can be anything, e.g. use netmon to discover what this traffic is) – user160083 Mar 28 '17 at 7:40
  • 1
    Please link to PCAP file. – KingJohnno Sep 24 '17 at 12:30
  • I voted to close until there is enough information to post an adequate, informed answer. As it’s currently written, there is just no way to tell. – Tobi Nary Oct 24 '17 at 10:13
-1

Probably it is a DOS attack.

Check the log carefully and verify the source IP of the request.

If it is a DOS attack,

the source IP's may look like
either

xxx.xxx.xxx.000 For all entries
Or

May be a group

xxx.xxx.xxx.000 xxx.xxx.xxx.001 xxx.xxx.xxx.002

Likewise

If you see random IP address repeatedly, it may be a DDOS attack.

Don't worry the Firewall will take care of it.

If it can't, either down the server by yourself or use a 302 temporary redirect

UPDATE

The firewall is efficiently preventing it. If you want it not to come, Just add a 302 for 1 or 2 hours to google.com or something and then remove it.

  • It is not random. Just 2 IP addresses. These two keep appearing in the firewall logs. – Shawn Sim Mar 28 '17 at 5:44
  • updated. Read more about 302 in the link in answer. – i-- Mar 28 '17 at 5:50
  • "Every few minutes" doesn't sound like DOS to me. – user155462 Aug 25 '17 at 7:46
  • @user155462 flood of requests will occur within a minute if it is a DDOS but the case of DOS is different – i-- Aug 25 '17 at 7:47
  • @i-- Not really. Both have the goal to flood, the difference is just how many computers try to flood you. (Read more about it at eg. Wikipedia, or here, or...). Otherwise, there is no "denial of service". A request every few minutes won't harm the server in any way. – user155462 Aug 25 '17 at 7:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.