Home / server / Questions / 408424
Accepted
Quango
Asked: 2012-07-18 00:22:59 +0800 CST

Is this a DNS vulnerability or exploit?

  • 772

Our server (windows 2008 R2 server, fully patched) this morning was a bit slow.

Checking network activity I found several DNS sessions using quite a lot of bandwidth (10MB/sec per session). This was rather suspicious (I expect DNS traffic to be light) so I turned off DNS for the present.

Here is an image of some of the connections: list of DNS sessions

As you can see there is a varied list of hosts. Is this a vulnerability in DNS?

windows-server-2008 domain-name-system vulnerability

1 Answers

  1. Best Answer

    Could be someone using TCP over DNS to get over some internet restrictions. You can counter this by implementing split horizon DNS.

    There is an interesting Q about this, over at Security.SE

    enter image description here

    • 8