[nsp-sec] Large dns attack to 208.80.125.4

[Janish, Nathan]

Hello,

We have a customer getting attacked with large ammounts of dns traffic.  Destination is 208.80.125.4 and we suspect a good portion of traffic is sourcing from China.  Any netflow information would be greatly appreciated.

bash-3.00$ nslookup 208.80.125.4

Server:         10.63.255.2

Address:        10.63.255.2#53

 

4.125.80.208.in-addr.arpa       name = ns13.dnsmadeeasy.com

Regards,

Nathan Janish
Level3 Network Security
720.888.0012