DMCA
Threats of Unusual DNS Query Traffic from NIS Clients
BibTeX
@MISC{Romaña_threatsof,
author = {Dennis A. Ludeña Romaña and Hirofumi Nagatomi and Yasuo Musashi and Kenichi Sugitani},
title = {Threats of Unusual DNS Query Traffic from NIS Clients},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract We statistically investigated on unusual DNS query traffic from the several Linux PC servers employing network information system (NIS) as their authentication in the campus network of a university. The following re-sults are obtained: (1) The DNS query traffic includes specific keywords of database servers in which one database is as a NIS server and the others are its NIS clients. (2) The DNS query traffic takes place when the NIS server crashes because recent NIS is carried out with libwrap that performs the name resolution. This name resolution is usually achieved with referring to a /etc/hosts or to the DNS server. Therefore, we can reasonably take a workaround to avoid the unusual DNS query traffic when configuring the specific keywords and their IP addresses in the /etc/hosts file. Key words DNS based Detection, NIS server, NIS clients 1.
