My Symantec end point traffic logs keep showing that inbound UDP traffic from the DNS server is blocked. This happens every few minutes. Is it a potential attack?
closed as unclear what you're asking by Tobi Nary, AJ Henderson, schroeder♦ Oct 24 '17 at 16:26
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Probably it is a DOS attack.
Check the log carefully and verify the source IP of the request.
If it is a DOS attack,
the source IP's may look like
For all entries
May be a group
xxx.xxx.xxx.000 xxx.xxx.xxx.001 xxx.xxx.xxx.002
If you see random IP address repeatedly, it may be a DDOS attack.
Don't worry the Firewall will take care of it.
If it can't, either down the server by yourself or use a 302 temporary redirect
The firewall is efficiently preventing it. If you want it not to come, Just add a 302 for 1 or 2 hours to google.com or something and then remove it.