DNS attack

[xuan.z]

I viewing pix log and I found some message below

%PIX-2-106020: Deny IP teardrop fragment (size = num, offset = num)

from IP_addr to DNS_addr

my dns server is attacked.what's cause this and how to resolve it?

Regards,

yuntao

[jmia]

Yuntao,

Explanation on 106020 log :

Error Message: %PIX-2-106020: Deny IP teardrop fragment (size = num, offset = num)

from IP_addr to IP_addr

Explanation:

The PIX Firewall discarded an IP packet with a teardrop signature containing either a small offset or fragment overlapping. This is a hostile event to circumvent the PIX Firewall or an Intrusion Detection System.

Recommended Action:

Contact the remote peer administrator or escalate this issue according to your security policy.

I would suggest that you contact your upstream provider (ISP) on this matter if you are seeing a lot of these messages on the pix log.

Hope this helps,

Jay