Abnormal SYN traffic from Blackhole DNS servers

Question

I have been getting alerts from an anomaly based signatures for abnormally high SYN traffic. The traffic is coming from blackhole DNS servers. I hadn't had any experience with Blackhole servers prior to this so all of what I know has come from Wikipedia: http://en.wikipedia.org/wiki/Blackhole_server

My question is:

Why would we be seeing SYN traffic from blackhole DNS servers? Is trafic being generated because of internal DNS servers inappropriately forwarding traffic out to the wild?

If it's relevant to the question, how do these servers function beyond what is in the wiki article?

Answer 1

Is this a spoofed SYN flood?

At first glance, this may look like an attack. An attacker can initiate a SYN Flood without using his real IP address. An attacker crafts a packet with an origin IP of a known IP such as that of a blackhole dns server. Your server may exhaust resources while attempting to respond with a SYN-ACK packet.

How can I tell

If your server does respond with a SYN-ACK packet, then the original packet is likely spoofed if the server doesn't respond with a final ACK packet.

Why am I seeing TCP traffic for DNS?

Per RFC6305

A request sent to one of these servers will result in a response being returned to the client. The response will typically be a UDP datagram, although it's perfectly valid for requests to be made over TCP. In both cases, the source port of packets returning to the site that originated the DNS request will be 53.

Explanations provided by RFC6305

Section 6 of RFC6305 provides further explanations of why you may see this traffic.

6. Inbound Traffic from AS112 Servers

   Where firewalls or intrusion detection systems (IDSs) are configured to block traffic received from AS112 servers, superficial review of the traffic may seem alarming to site administrators.

   Since requests directed ultimately to AS112 servers are usually triggered automatically by applications, review of firewall logs may indicate a large number of policy violations occurring over an extended period of time.

   Where responses from AS112 servers are blocked by firewalls, hosts will often retry, often with a relatively high frequency. This can cause inbound traffic to be misclassified as a denial-of- service (DoS) attack. In some cases, the source ports used by individual hosts for successive retries increase in a predictable fashion (e.g. monotonically), which can cause the replies from the AS112 server to resemble a port scan.

   A site administrator may attempt to perform active measurement of the remote host in response to alarms raised by inbound traffic, e.g. initiating a port scan in order to gather information about the host which is apparently attacking the site. Such a scan will usually result in additional inbound traffic to the site performing the measurement, e.g., an apparent flood of ICMP messages that may trigger additional firewall alarms and obfuscate the process of identifying the originally problematic traffic.