DNS reflection attack - What does this mean?

Your machine has been used as part of an DNS reflection attack, and we have null routed the source IP **.**.***.***. We will continue to monitor this situation, the null route may remain in place for up to 4 hours.

This configuration issue is normally the result of your DNS server being an open resolver.

Please prevent open resolving of DNS queries on this server to avoid issues in the future.

Click to expand...

A DNS amplification attack (aka DNS reflection attack) is a type of distributed denial of service (DDos) attack that takes advantage of the fact that a small DNS query can generate a much larger response. When combined with source address spoofing, an attacker can direct a large volume of network traffic to a target system by initiating relatively small DNS queries.

Click to expand...

W130SN said:

If you Google "DNS reflection attack" you will find the answer.



http://technet.microsoft.com/en-us/security/hh972393.aspx

http://lmgtfy.com/?q=DNS+reflection+attack

Click to expand...

Please prevent open resolving of DNS queries on this server to avoid issues in the future.

Click to expand...

warner410 said:

Too technical for me.

I want to know how can such a situation can be avoided in future. What does this mean?

Click to expand...

SharkServers said:

The situation can be avoided by properly configuring the software running on your VPS - particularly, the DNS server. As you said, it's too technical for you, so you better get someone knowledgeable to do that for you.

If you decide to look for someone to help you with this, mention that you need to disable recursive queries for the DNS server, which is exactly what you need done to prevent this sort of issue in the future.

Click to expand...

warner410 said:

I am using Windows Server 2008 R2.

When I go to Server Management > Roles > DNS Server is not installed.

Can a deflection attack happen even without the DNS server being installed?

Click to expand...