Topic: [Solved] Excessive DNS Requests?

[smiit]

I received a message from my ISP's abuse department yesterday complaining of excessive DNS requests.  Never had a complaint from them in the 5 years we've been running SME.

Any suggestions on how I might analyze network traffic to figure out what's going on?

Should I concentrate on UDP 53 traffic or could it be any sort of rogue mail worm causing trouble on various ports?

Thanks in advance if anyone has any tips or usage examples using tcpdump, iptraf or nmap.

[cactus]

I received a message from my ISP's abuse department yesterday complaining of excessive DNS requests.  Never had a complaint from them in the 5 years we've been running SME.

Any suggestions on how I might analyze network traffic to figure out what's going on?

Should I concentrate on UDP 53 traffic or could it be any sort of rogue mail worm causing trouble on various ports?

Thanks in advance if anyone has any tips or usage examples using tcpdump, iptraf or nmap.

AFAIK SME Server does it's own name resolution for itself and it's configured networks unless you have set a external DNS server through the admin console. Perhaps they are referring to that type of traffic?

[smiit]

Just received an e-mail from the ISP - an error on their end kicked out the abuse warning - they now claim customers have outdated firmware on their provided routers and/or there still may be a rogue client machine flooding spam around.

[thomasch]

I received a message from my ISP's abuse department yesterday complaining of excessive DNS requests.  Never had a complaint from them in the 5 years we've been running SME.

Any suggestions on how I might analyze network traffic to figure out what's going on?

Should I concentrate on UDP 53 traffic or could it be any sort of rogue mail worm causing trouble on various ports?

Thanks in advance if anyone has any tips or usage examples using tcpdump, iptraf or nmap.

I 've seen DNS Flood Alert in my ADSL router when SMEserver querying a list of DNS server out there (hundreds). Maybe this kind of request that alerts yourISP for 'excessive DNS request'. Nothing to worry about though. This is by design.

thomas