Is it DNS attack? Pls advice.

[wanghmk1223]

Has anyone come across massive outbound traffic from your users connecting to 192.175.48.1,192.175.48.42,192.175.48.6 via port 53?

Is it ok to block these traffic?

Pls advice.

[sachinraja]

These addresses are from prisoner.iana.org, which are somethin called as blackhole servers. you dont need access to these servers on port 53.. block them..

http://www.experts-exchange.com/Security/Firewalls/Q_20736108.html

hope this helps.. all the best..

Raj