3

When I plug my router with a public IP address on it into the network, I get discovered after few hours to days and become 'flooded' with DNS requests from many sources. Who generates these requests? What does he gain from them?

I set up my firewall so it drops all UDP and TCP port 53 requests on WAN interface, so it does not bother me anymore. Is there a better way to do it?

| improve this question | |
  • Do you have Static IP address? or maybe Dynamic DNS, or domain that forward to your IP address – Alex Aug 14 '17 at 7:16
  • I removed the reference to the off-topic, consumer-grade equipment. It is necessary to have a firewall that blocks all incoming traffic originated from outside your network. It is just too easy for the bad guys to try many, many different exploits because they are automated. One little crack in your defenses will allow your network to be compromised. – Ron Maupin♦ Aug 14 '17 at 11:26
3

Many (really, really many) bots scan all Internet public IP all time, and try to exploit any weakness found in many way.

Specifically, DNS is often used to perform DDOS attack by amplification, see dns reflection attack vs dns amplification attack for more information.

| improve this answer | |
  • Thanks for fast response. So these requests I was able to sniff were forged to DDoS some poor guy on the other side. My initially bad configuration actually responded to these requests helping the bad guys to do bad stuff. Am I getting it right? – Jaroslav Hlaváč Aug 14 '17 at 8:31
  • 1
    this is a possibility, no certainty here about what actually happened. The point is that an Internet-facing devices must be correctly firewalled and configured to prevent such nasty things. – JFL Aug 14 '17 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.