近一段时间dns的流量异常，流量被冲击得很大


bind9的query日志：
10-Apr-2008 00:43:04.675 queries: client 61.132.220.84#2726: view telecom: query: sina.com IN A +
10-Apr-2008 00:43:04.675 queries: client 61.132.220.84#2643: view telecom: query: sina.com IN A +
10-Apr-2008 00:43:04.675 queries: client 61.132.220.84#2741: view telecom: query: sina.com IN A +
10-Apr-2008 00:43:04.675 queries: client 61.132.220.84#2698: view telecom: query: sina.com IN A +
10-Apr-2008 00:43:04.675 queries: client 61.132.220.84#2612: view telecom: query: sina.com IN A +
。。。。。
google了一下，应该是dns放大攻击
http://www.hackhome.com/InfoView/Article_173472.html
前天做了一下调整，主要是named.conf
recursion no; 禁止递归查询
allow-query {
211.67.64.0/16;
210.42.140.0/23;
};  限制客户端的query范围
transfer-format one-answer; 设定传送方式
从流量图可以看到，out流量明显减少，但是in方向的流量仍然无改色，办法继续寻找中。
在bind9的run日志中可以看到拒绝的效果：
10-Apr-2008 01:13:28.216 security: client 61.132.220.84#2653: view telecom: query (cache) ’sina.com/A/IN’ denied
10-Apr-2008 01:13:28.217 security: client 61.132.220.84#2702: view telecom: query (cache) ’sina.com/A/IN’ denied
10-Apr-2008 01:13:28.217 security: client 61.132.220.84#2687: view telecom: query (cache) ’sina.com/A/IN’ denied
10-Apr-2008 01:13:28.217 security: client 61.132.220.84#2626: view telecom: query (cache) ’sina.com/A/IN’ denied
10-Apr-2008 01:13:28.217 security: client 61.132.220.84#2658: view telecom: query (cache) ’sina.com/A/IN’ denied