README
1DNS FLood Detector 1.2
2Dennis Opacki
3dopacki@adotout.com
4
5
6What is DNS Flood Detector?
7
8DNS Flood Detector was developed to detect abusive usage levels on high
9traffic nameservers and to enable quick response to the use of one's
10nameserver to facilitate spam. DNS Flood Detector is distributed under the
11Gnu Public License (see included LICENSE file for details).
12
13How does it work?
14
15DNS Flood Detector uses libpcap (in non-promiscuous mode) to monitor
16incoming dns queries to a nameserver. The tool may be run in one of two
17modes, either daemon mode or "bindsnap" mode. In daemon mode, the tool
18will alarm via syslog. In bindsnap mode, the user is able to get
19near-real-time stats on usage to aid in more detailed troubleshooting.
20By default, it will count dns queries directed to any address in the same
21network as the primary IP address on the interface being watched; the -A,
22-M, and -Q options can be used to modify this behaviour.
23
24As of version 1.2, DNS Flood Detector can now send source IP request
25data to a network-based collector as JSON. This lets you gather near
26real-time information about who is using your DNS servers, and from
27where. I've included a sample application called dns_flood_collector.pl,
28which you can use to receive and report these data. The output of this
29program can be easily fed into a graphing tool, such as Caida's
30plot-latlong:
31
32http://www.caida.org/tools/visualization/plot-latlong/
33
34How do I build it?
35
36Execute ./configure.pl to select the appropriate make target. Then simply
37type "make".
38
39Why was it written?
40
41I wrote DNS Flood Detector because the fifty or so public recursive
42nameservers I am responsible for were being abused by both customers and
43non-customers. DNS Flood Detector allows for prompt action when anomalous
44conditions are detected.
45
46What do I need to use it?
47
48You need libpcap and a little bit of patience.
49
50What platforms does it work on?
51
52Linux, BSDI, FreeBSD, Mac OSX, Solaris
53
54Will it run under Windows {95,98,NT,2000,XP,2003,2008 or Win7}?
55
56Maybe. I haven't tried. If it doesn't, feel free to submit a fix.
57
58What does it look like?
59
60Usage: ./dns_flood_detector [OPTION]
61
62-i IFNAME specify interface to listen on
63-t N alarm at >N queries per second
64-a N reset alarm after N seconds
65-w N calculate stats every N seconds
66-x N create N buckets
67-m N mark total query rate every N seconds
68-A addr filter for specific address
69-M mask netmask for filter (in conjunction with -A)
70-Q don't filter by local interface address
71-b run in foreground in bindsnap mode
72-d run in background in daemon mode
73-D dump dns packets (implies -b)
74-v verbose output - use again for more verbosity
75-s send source IP stats to collector as JSON
76-z N.N.N.N address to send stats to (default 226.1.1.2)
77-p N UDP port to send stats to (default 2000)
78-h display this usage information
79
80Sample Output:
81
82dopacki:~$ sudo ./dns_flood_detector -v -v -b -t10
83[15:14:56] source [192.168.1.45] - 0 qps tcp : 24 qps udp [8 qps A] [16 qps PTR]
84[15:14:56] source [10.0.24.2] - 0 qps tcp : 15 qps udp [15 qps A]
85[15:15:06] source [192.168.1.45] - 0 qps tcp : 24 qps udp [8 qps A] [16 qps PTR]
86[15:15:06] source [10.0.24.2] - 0 qps tcp : 15 qps udp [14 qps A]
87[15:15:16] source [192.168.1.45] - 0 qps tcp : 23 qps udp [7 qps A] [15 qps PTR]
88
89What if I have questions?
90
91You can e-mail me at dopacki@adotout.com
92