DNS ANY Request Cannon Activity in DNS Query Packet Traffic
DNS ANY Request Cannon Activity in DNS Query Packet Traffic
复制标题
DNS 查询数据包流量中的 DNS ANY 请求大炮活动
DOI：
10.1109/icinis.2013.53
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Toshiyuki Moriyama
中科院分区：
文献类型：
--
作者：
Yuto Takeda;Y. Musashi;K. Sugitani;Toshiyuki Moriyama
我们统计调查了2011年1月1日至2012年12月31日从互联网到顶级域名DNS服务器的基于ANY资源记录（RR）的DNS查询请求数据包流量。得到的结果是：（1）我们发现在2011年11月28日，基于ANY RR的DNS查询请求流量显著增加。(2)在DNS查询请求包流量中，我们只观察到校园域名的查询关键字。(3)我们发现总入站DNS查询请求数据包流量和包括查询关键字的DNS查询请求数据包流量之间存在相关性。(4)此外，我们进行了负载测试，向测试DNS服务器发送ANY，A和PTR RR唯一DNS查询，我们观察到vmstat参数之间没有差异，负载值为0.10-0.20。这些结果表明，基于ANY RR的DNS请求数据包流量非常奇怪。但这应该是无意义的活动。
We statistically investigated the total ANY resource record (RR) based DNS query request packet traffic from the Internet to the top domain DNS server in a university campus network through January 1st, 2011 to December 31st, 2012. The obtained results are: (1) We found a significant increase in the inbound ANY RR based DNS query request traffic at November 28th, 2011. (2) In the DNS query request packet traffic, we observed only a query keyword of the campus domain name. (3) We found a correlation between the total inbound DNS query request packet traffic and the DNS query request packet traffic including the query keyword. (4) Also, we carried out the loading test sending ANY, A, and PTR RR unique DNS queries to a test DNS server, we observed no difference among the vmstat parameters, and the load value was 0.10-0.20. These results indicate that the ANY RR based DNS request packet traffic is quite strange. However, it should be meaningless activity.