I have been getting alerts from an anomaly based signatures for abnormally high SYN traffic. The traffic is coming from blackhole DNS servers. I hadn't had any experience with Blackhole servers prior to this so all of what I know has come from Wikipedia: http://en.wikipedia.org/wiki/Blackhole_server

My question is:

Why would we be seeing SYN traffic from blackhole DNS servers? Is trafic being generated because of internal DNS servers inappropriately forwarding traffic out to the wild?

If it's relevant to the question, how do these servers function beyond what is in the wiki article?


1 Answer 1


Is this a spoofed SYN flood?

At first glance, this may look like an attack. An attacker can initiate a SYN Flood without using his real IP address. An attacker crafts a packet with an origin IP of a known IP such as that of a blackhole dns server. Your server may exhaust resources while attempting to respond with a SYN-ACK packet.

How can I tell

If your server does respond with a SYN-ACK packet, then the original packet is likely spoofed if the server doesn't respond with a final ACK packet.

Why am I seeing TCP traffic for DNS?

Per RFC6305

A request sent to one of these servers will result in a response being returned to the client. The response will typically be a UDP datagram, although it's perfectly valid for requests to be made over TCP. In both cases, the source port of packets returning to the site that originated the DNS request will be 53.

Explanations provided by RFC6305

Section 6 of RFC6305 provides further explanations of why you may see this traffic.

  1. Inbound Traffic from AS112 Servers

Where firewalls or intrusion detection systems (IDSs) are configured to block traffic received from AS112 servers, superficial review of the traffic may seem alarming to site administrators.

  Since requests directed ultimately to AS112 servers are usually
  triggered automatically by applications, review of firewall logs
  may indicate a large number of policy violations occurring over an
  extended period of time.

  Where responses from AS112 servers are blocked by firewalls, hosts
  will often retry, often with a relatively high frequency.  This
  can cause inbound traffic to be misclassified as a denial-of-
  service (DoS) attack.  In some cases, the source ports used by
  individual hosts for successive retries increase in a predictable
  fashion (e.g. monotonically), which can cause the replies from the
  AS112 server to resemble a port scan.

  A site administrator may attempt to perform active measurement of
  the remote host in response to alarms raised by inbound traffic,
  e.g. initiating a port scan in order to gather information about
  the host which is apparently attacking the site.  Such a scan will
  usually result in additional inbound traffic to the site
  performing the measurement, e.g., an apparent flood of ICMP
  messages that may trigger additional firewall alarms and obfuscate
  the process of identifying the originally problematic traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.