DNS DDoS攻撃の現状
DNSへのDDoS攻撃について、
先日書いた、IPTABLESの対応でログが爆発するなどの実害はなくなったけど、
実際の処どれくらいの問い合わせ攻撃がきてるかtcpdumpで調べてみた。
大体１秒間に120～170の攻撃がのべつまくなしに来ていることがわかった。
まあ、スクリプトなどで自動でやっているから収まることはないんだろうね。
一回１０個の問い合わせがセットで、IPアドレスを順次変えてやっている。
前は、中国、香港が中心だったけど今は世界中のアドレスを使いまわしている。
DNSはUDPのコネクションレスだから、詐称はかんたんなんですかね？？
各ISPのルータがあり得ないソースIPを全部遮断してくれればいいような
気がするけど。そんな単純なものじゃないのかね？？
それとも本当にそのIPアドレスから攻撃してるのかな？？
だとすると世界中にのっとりの成功したPCがあって連携してやってるとか？？
恐ろしや。
でも違うソースIPのセットの攻撃が時間的にオーバーラップすることがないことを見ると
やっぱり１か所からIP詐称でやってるっぽいね。
以下１秒間のDDOSダンプ
===========================================================================
09:58:18.009087 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009115 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009122 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009126 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009132 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009136 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009140 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009144 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009148 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009158 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009162 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009166 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009170 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009174 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009177 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.072950 IP 151.101.10.93.48611 > xxx.xxx.xxx.domain: 17630+ [1au] ANY? learnengs.com. (50)
09:58:18.076421 IP 151.101.10.93.19151 > xxx.xxx.xxx.domain: 35167+ [1au] ANY? learnengs.com. (50)
09:58:18.137285 IP 151.101.130.93.46939 > xxx.xxx.xxx.domain: 53240+ [1au] ANY? learnengs.com. (50)
09:58:18.175395 IP 151.101.130.93.59406 > xxx.xxx.xxx.domain: 39515+ [1au] ANY? learnengs.com. (50)
09:58:18.209705 IP 151.101.130.93.52473 > xxx.xxx.xxx.domain: 43823+ [1au] ANY? learnengs.com. (50)
09:58:18.226683 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.226716 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.226722 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.226725 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.326265 IP 151.101.10.93.20224 > xxx.xxx.xxx.domain: 53494+ [1au] ANY? learnengs.com. (50)
09:58:18.363687 IP 151.101.130.93.45763 > xxx.xxx.xxx.domain: 63088+ [1au] ANY? learnengs.com. (50)
09:58:18.392089 IP 151.101.130.93.16770 > xxx.xxx.xxx.domain: 22454+ [1au] ANY? learnengs.com. (50)
09:58:18.465357 IP 151.101.10.93.56234 > xxx.xxx.xxx.domain: 28509+ [1au] ANY? learnengs.com. (50)
09:58:18.474337 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474358 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474367 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474372 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474377 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474381 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474385 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.519828 IP 151.101.10.93.27749 > xxx.xxx.xxx.domain: 45177+ [1au] ANY? learnengs.com. (50)
09:58:18.530932 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530960 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530965 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530967 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530970 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530972 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530974 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530977 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530979 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530981 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530983 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530986 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530988 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530990 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530992 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.546277 IP 151.101.130.93.5659 > xxx.xxx.xxx.domain: 25399+ [1au] ANY? learnengs.com. (50)
09:58:18.571619 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571667 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571673 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571676 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571680 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571683 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571686 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571690 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571694 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.578646 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578661 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578665 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578668 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578670 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578672 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578675 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578677 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578679 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578682 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578684 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578686 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578689 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578691 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578693 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.599062 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599145 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599154 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599159 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599164 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599171 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599176 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599181 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599185 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599190 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599193 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599196 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599199 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599203 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599206 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.808210 IP 151.101.130.93.63447 > xxx.xxx.xxx.domain: 54208+ [1au] ANY? learnengs.com. (50)
09:58:18.808368 IP 151.101.130.93.12478 > xxx.xxx.xxx.domain: 62296+ [1au] ANY? learnengs.com. (50)
09:58:18.813200 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813215 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813218 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813220 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813223 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813562 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813574 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813589 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813593 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813597 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813600 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813604 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813607 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813610 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813614 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.829064 IP 151.101.10.93.18677 > xxx.xxx.xxx.domain: 18080+ [1au] ANY? learnengs.com. (50)
09:58:18.902994 IP 151.101.130.93.27508 > xxx.xxx.xxx.domain: 7547+ [1au] ANY? learnengs.com. (50)
09:58:18.928778 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928832 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928840 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928846 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928852 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928858 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928864 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928869 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928875 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928880 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928885 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928891 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928896 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928902 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928907 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928911 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928917 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.939079 IP 151.101.130.93.33367 > xxx.xxx.xxx.domain: 52673+ [1au] ANY? learnengs.com. (50)
09:58:18.979474 IP 151.101.10.93.23805 > xxx.xxx.xxx.domain: 41616+ [1au] ANY? learnengs.com. (50)
先日書いた、IPTABLESの対応でログが爆発するなどの実害はなくなったけど、
実際の処どれくらいの問い合わせ攻撃がきてるかtcpdumpで調べてみた。
大体１秒間に120～170の攻撃がのべつまくなしに来ていることがわかった。
まあ、スクリプトなどで自動でやっているから収まることはないんだろうね。
一回１０個の問い合わせがセットで、IPアドレスを順次変えてやっている。
前は、中国、香港が中心だったけど今は世界中のアドレスを使いまわしている。
DNSはUDPのコネクションレスだから、詐称はかんたんなんですかね？？
各ISPのルータがあり得ないソースIPを全部遮断してくれればいいような
気がするけど。そんな単純なものじゃないのかね？？
それとも本当にそのIPアドレスから攻撃してるのかな？？
だとすると世界中にのっとりの成功したPCがあって連携してやってるとか？？
恐ろしや。
でも違うソースIPのセットの攻撃が時間的にオーバーラップすることがないことを見ると
やっぱり１か所からIP詐称でやってるっぽいね。
以下１秒間のDDOSダンプ
===========================================================================
09:58:18.009087 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009115 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009122 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009126 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009132 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009136 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009140 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009144 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009148 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009158 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009162 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009166 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009170 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009174 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.009177 IP ec2-13-124-58-20.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 17681+ [1au] ANY? cpsc.gov. (37)
09:58:18.072950 IP 151.101.10.93.48611 > xxx.xxx.xxx.domain: 17630+ [1au] ANY? learnengs.com. (50)
09:58:18.076421 IP 151.101.10.93.19151 > xxx.xxx.xxx.domain: 35167+ [1au] ANY? learnengs.com. (50)
09:58:18.137285 IP 151.101.130.93.46939 > xxx.xxx.xxx.domain: 53240+ [1au] ANY? learnengs.com. (50)
09:58:18.175395 IP 151.101.130.93.59406 > xxx.xxx.xxx.domain: 39515+ [1au] ANY? learnengs.com. (50)
09:58:18.209705 IP 151.101.130.93.52473 > xxx.xxx.xxx.domain: 43823+ [1au] ANY? learnengs.com. (50)
09:58:18.226683 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.226716 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.226722 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.226725 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.62468 > xxx.xxx.xxx.domain: 40793+ [1au] ANY? fema.gov. (37)
09:58:18.326265 IP 151.101.10.93.20224 > xxx.xxx.xxx.domain: 53494+ [1au] ANY? learnengs.com. (50)
09:58:18.363687 IP 151.101.130.93.45763 > xxx.xxx.xxx.domain: 63088+ [1au] ANY? learnengs.com. (50)
09:58:18.392089 IP 151.101.130.93.16770 > xxx.xxx.xxx.domain: 22454+ [1au] ANY? learnengs.com. (50)
09:58:18.465357 IP 151.101.10.93.56234 > xxx.xxx.xxx.domain: 28509+ [1au] ANY? learnengs.com. (50)
09:58:18.474337 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474358 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474367 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474372 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474377 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474381 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.474385 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.10559 > xxx.xxx.xxx.domain: 27854+ [1au] ANY? fema.gov. (37)
09:58:18.519828 IP 151.101.10.93.27749 > xxx.xxx.xxx.domain: 45177+ [1au] ANY? learnengs.com. (50)
09:58:18.530932 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530960 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530965 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530967 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530970 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530972 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530974 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530977 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530979 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530981 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530983 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530986 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530988 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530990 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.530992 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.546277 IP 151.101.130.93.5659 > xxx.xxx.xxx.domain: 25399+ [1au] ANY? learnengs.com. (50)
09:58:18.571619 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571667 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571673 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571676 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571680 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571683 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571686 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571690 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.571694 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.28183 > xxx.xxx.xxx.domain: 33089+ [1au] ANY? fema.gov. (37)
09:58:18.578646 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578661 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578665 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578668 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578670 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578672 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578675 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578677 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578679 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578682 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578684 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578686 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578689 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578691 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.578693 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 7341+ [1au] ANY? cpsc.gov. (37)
09:58:18.599062 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599145 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599154 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599159 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599164 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599171 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599176 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599181 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599185 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599190 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599193 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599196 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599199 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599203 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.599206 IP ec2-52-78-204-213.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 12913+ [1au] ANY? cpsc.gov. (37)
09:58:18.808210 IP 151.101.130.93.63447 > xxx.xxx.xxx.domain: 54208+ [1au] ANY? learnengs.com. (50)
09:58:18.808368 IP 151.101.130.93.12478 > xxx.xxx.xxx.domain: 62296+ [1au] ANY? learnengs.com. (50)
09:58:18.813200 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813215 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813218 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813220 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813223 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813562 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813574 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813589 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813593 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813597 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813600 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813604 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813607 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813610 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.813614 IP ec2-13-124-125-237.ap-northeast-2.compute.amazonaws.com.krb524 > xxx.xxx.xxx.domain: 41228+ [1au] ANY? cpsc.gov. (37)
09:58:18.829064 IP 151.101.10.93.18677 > xxx.xxx.xxx.domain: 18080+ [1au] ANY? learnengs.com. (50)
09:58:18.902994 IP 151.101.130.93.27508 > xxx.xxx.xxx.domain: 7547+ [1au] ANY? learnengs.com. (50)
09:58:18.928778 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928832 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928840 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928846 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928852 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928858 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928864 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.38964 > xxx.xxx.xxx.domain: 59736+ [1au] ANY? fema.gov. (37)
09:58:18.928869 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928875 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928880 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928885 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928891 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928896 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928902 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928907 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928911 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.928917 IP ec2-13-124-58-97.ap-northeast-2.compute.amazonaws.com.53555 > xxx.xxx.xxx.domain: 60295+ [1au] ANY? fema.gov. (37)
09:58:18.939079 IP 151.101.130.93.33367 > xxx.xxx.xxx.domain: 52673+ [1au] ANY? learnengs.com. (50)
09:58:18.979474 IP 151.101.10.93.23805 > xxx.xxx.xxx.domain: 41616+ [1au] ANY? learnengs.com. (50)
