本日 2017/04/03 11時頃から、DNSサーバーに対して、特定IPアドレスから意味不明の連続パケットが到着しています。
Webサービスを運用していますので、DNSサーバーへ名前解決リクエストパケットが届くのは当たり前なのですが、パケットが一発届いて、応答パケットを一発返して、終了するはずです。ネットワーク障害などで、リクエストパケットや応答パケットが途中消滅してしまった場合には、再度名前解決シーケンスがリトライされることはあるはずですが、それはある程度のタイムアウト時間を置いての話。
ファイヤーウォールログを見ると、全く同じ UDP 53 へのパケットが1秒以内に連続5発到着するということが、以下のログにあるように、5時間以上延々と繰り返されています。
Apr 4 11:28:08 dns kernel: ipfw: Accept UDP 75.190.48.57:8636 116.58.172.107:53 in via tun0 Apr 4 11:28:08 dns last message repeated 4 times Apr 4 11:28:10 dns kernel: ipfw: Accept UDP 24.127.91.109:65235 116.58.172.107:53 in via tun0 Apr 4 11:28:10 dns last message repeated 4 times Apr 4 11:28:11 dns kernel: ipfw: Accept UDP 98.14.215.138:61547 116.58.172.107:53 in via tun0 Apr 4 11:28:11 dns last message repeated 4 times Apr 4 11:28:13 dns kernel: ipfw: Accept UDP 174.141.135.242:18462 116.58.172.107:53 in via tun0 Apr 4 11:28:13 dns last message repeated 4 times Apr 4 11:28:15 dns kernel: ipfw: Accept UDP 170.253.168.182:35656 116.58.172.107:53 in via tun0 Apr 4 11:28:15 dns last message repeated 4 times Apr 4 11:28:18 dns kernel: ipfw: Accept UDP 107.169.246.6:34436 116.58.172.107:53 in via tun0 Apr 4 11:28:18 dns last message repeated 4 times Apr 4 11:28:20 dns kernel: ipfw: Accept UDP 72.152.34.41:40826 116.58.172.107:53 in via tun0 Apr 4 11:28:20 dns last message repeated 4 times Apr 4 11:28:21 dns kernel: ipfw: Accept UDP 97.104.218.208:42296 116.58.172.107:53 in via tun0 Apr 4 11:28:21 dns last message repeated 4 times Apr 4 11:28:21 dns kernel: ipfw: Accept UDP 73.20.78.45:57103 116.58.172.107:53 in via tun0 Apr 4 11:28:21 dns last message repeated 4 times Apr 4 11:28:23 dns kernel: ipfw: Accept UDP 75.190.48.57:59034 116.58.172.107:53 in via tun0 Apr 4 11:28:23 dns last message repeated 4 times Apr 4 11:28:24 dns kernel: ipfw: Accept UDP 24.127.91.109:38479 116.58.172.107:53 in via tun0 Apr 4 11:28:24 dns last message repeated 4 times Apr 4 11:28:25 dns kernel: ipfw: Accept UDP 98.14.215.138:11751 116.58.172.107:53 in via tun0 Apr 4 11:28:25 dns last message repeated 4 times Apr 4 11:29:05 dns kernel: ipfw: Accept UDP 75.190.48.57:6174 116.58.172.107:53 in via tun0 Apr 4 11:29:05 dns last message repeated 4 times Apr 4 11:29:07 dns kernel: ipfw: Accept UDP 24.127.91.109:33091 116.58.172.107:53 in via tun0 Apr 4 11:29:07 dns last message repeated 4 times Apr 4 11:29:08 dns kernel: ipfw: Accept UDP 98.14.215.138:18671 116.58.172.107:53 in via tun0 Apr 4 11:29:08 dns last message repeated 4 times Apr 4 11:29:12 dns kernel: ipfw: Accept UDP 174.141.135.242:24560 116.58.172.107:53 in via tun0 Apr 4 11:29:12 dns last message repeated 4 times Apr 4 11:29:15 dns kernel: ipfw: Accept UDP 107.169.246.6:14336 116.58.172.107:53 in via tun0 Apr 4 11:29:15 dns last message repeated 4 times Apr 4 11:29:18 dns kernel: ipfw: Accept UDP 97.104.218.208:49343 116.58.172.107:53 in via tun0 Apr 4 11:29:18 dns last message repeated 4 times Apr 4 11:29:18 dns kernel: ipfw: Accept UDP 72.152.34.41:43571 116.58.172.107:53 in via tun0 Apr 4 11:29:18 dns last message repeated 4 times Apr 4 11:29:18 dns kernel: ipfw: Accept UDP 73.20.78.45:60671 116.58.172.107:53 in via tun0 Apr 4 11:29:18 dns last message repeated 4 times Apr 4 11:29:19 dns kernel: ipfw: Accept UDP 75.190.48.57:17151 116.58.172.107:53 in via tun0 Apr 4 11:29:19 dns last message repeated 4 times Apr 4 11:29:21 dns kernel: ipfw: Accept UDP 24.127.91.109:7979 116.58.172.107:53 in via tun0 Apr 4 11:29:21 dns last message repeated 4 times Apr 4 11:29:22 dns kernel: ipfw: Accept UDP 170.253.168.182:42757 116.58.172.107:53 in via tun0 Apr 4 11:29:22 dns last message repeated 4 times Apr 4 11:29:23 dns kernel: ipfw: Accept UDP 98.14.215.138:49816 116.58.172.107:53 in via tun0 Apr 4 11:29:23 dns last message repeated 4 times
これって一体何を狙ったアクセス？
念のために、named_sec.log を確認してみると、アクセス拒否のログが大量に残っていました。
04-Apr-2017 11:28:24.545 security: client @0x291b5900 24.127.91.109#38479 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:24.546 security: client @0x291b5900 24.127.91.109#38479 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:24.546 security: client @0x291b5900 24.127.91.109#38479 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:24.546 security: client @0x291b5900 24.127.91.109#38479 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:24.547 security: client @0x291b5900 24.127.91.109#38479 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:25.607 security: client @0x291b5900 98.14.215.138#11751 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:25.607 security: client @0x291b5900 98.14.215.138#11751 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:25.608 security: client @0x291b5900 98.14.215.138#11751 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:25.609 security: client @0x291b5900 98.14.215.138#11751 (.): query (cache) './ANY/IN' denied 04-Apr-2017 11:28:25.609 security: client @0x291b5900 98.14.215.138#11751 (.): query (cache) './ANY/IN' denied
query (cache) ‘./ANY/IN’ denied で拒否になっているので、DNSシステムに問題はなさそうですが、ログが急速に膨れあがっています。
ソースIPアドレスの数が20個以下なので、ファイヤーウォールのフィルターで UDP 53 パケットを捨てる事にしてみました。
ひょっとして、これって、DNSリフレクター攻撃？