win2003 domain controller flood of outbound port 53 UDP


Recommended Posts

hello neowinians,

I will need your expert help on this one. One of my customers has a windows server 2003 domain controller, and lately we've been noticing a flood of outbound port 53 UDP connections originating from the domain controller. While I know port 53 TCP and UDP is being used by DNS, I'm confused about what could possibly generate such load of traffic.

The network performance at the customers is suffering a lot from this flood... I'm afraid this could be some sort of attack, but why are the connections outbound?

Possibly usefull info:

Some of the client computers on the network (they us DNS from the domain controller) show a lot of outbound UDP connections in high ports (+30000). Could they be the cause of the UDP 53 outbound connections on the domain controller?

Many thanks for reading this people!

Hmmm if you have clients doing a lot of dns queries, sure the source port is going to be random port above 1024 to port 53 UDP, udp is the default dns port - it only switches to tcp if failure or doing a zone transfer, etc. UDP is limited is size, so it will switch to tcp when doing large requests, etc.

example of dns query from one of my clients to my dns.

13:10:13.082077 IP quad-w7.local.lan.60548 > p4-28g.local.lan.53: 1627+ A? www.google.com. (32)

13:10:13.082634 IP p4-28g.local.lan.53 > quad-w7.local.lan.60548: 1627 7/4/0 CNAME www.l.google.com.,[|domain]

As you can see its source port is 60548 to 53, and then when the server answers back its from 53 to that destination port of 60548

You could watch the dns traffic with your fav sniffer, be it wireshark or something as simple as windump (windows version of tcpdump)

http://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/packet-capture/winpcap/windump/

Or you could use something like dnstop - if you a linux box that you can view traffic on your network with -- this can give you great summary and insight to what queries are being made.

http://dns.measurement-factory.com/tools/dnstop/

If a client is infected with something this could generate lots of dns, or say something like p2p can generate a **** load of dns queries if the client is setup to lookup all the connections host name, etc.

You might want to enable logging on dns so you can view these queries and see what is being looked up.

http://thelazyadmin.com/blogs/thelazyadmin/archive/2006/02/16/DNS-Tips-_2300_14-_2D00_-DNS-Logging.aspx

But yeah if you have a client that is generating lots of queries to your dns that are not part of your domain or cached already, then up your dns box is going to have to either forward that to your isp dns, or directly query root servers for all the requests.. So if you have lots of clients doing lots of queries for something like p2p -- it could generate a **** load of outbound queries from your dns box. It also just be typical web browsing -- if you have a lot of clients doing a lot of browsing to different sites that are not cached - yup your dns is going to have to go get the answers.

Getting a handle on what is actually being looked up will help you track down the root cause of all the queries.

edit: BTW you have your clients only setup to query your Domain Controller for DNS -- right?? Members of Active Directory should have only AD dns servers listed.. So when you say your clients are creating outbound dns queries - they are to your DC correct?? Client computers should not have any dns servers listed other than your AD dns server(s).

edit: Also don't be caught off guard on how much dns going to a single site can generate. Its quite possible for a simple site like neowin to generate lots of queries - ads on the page are being served from non neowin servers. You have other hosts on sites like images.domain.tld, css.domain.tld, js.domain.tld, forums., news. it depends on how the site is coded, etc. But a single website could quite easy generate 10 queries for FQDN, etc. So if you have 100 users browsing, it could generate quite a bit of dns traffic. Now hopefully your dns is caching these entries -- so as things become cached you'll see less outbound queries. But yeah it can be amazing how much dns traffic 100 users browsing can create ;) Now throw in some spam malware or p2p and sure it could overload your dns quite easy.

edit: for example I just checked on just going to the news page on neowin.net -- look at all the fdqn that would have to be looked up

a.colletive-media.net

ad.doubleclick.net

ad2.netshelter.net

ajax.googleapis.com

google-analytics.com

googleads.g.doubleclick.net

kona.kontera.com

kona5.kontera.com

konax.kontera.com

neowin.net

pageads2.googlesyndication.com

s0.2mdn.net

spe.atdmt.com

te.kontera.com

view.atdmt.com

so see how lots of people browsing to lots of sites could quite quickly cause lots of queries ;)

Edited by BudMan

Best thing you can do is wireshark it (sniffer) really. We can only make assumaptions as to what it is otherwise... DNS is a "chatty" protocol especially if there is a lot of web browsing going on.

Get a dump then we can take a better look.

Not sure I would use the term chatty ;)

But yup a name server having to do a full recursive lookup for some fqdn can generate some traffic for sure ;) Keep in mind has to find out what nameserver owns domainx, then has to query domainx name server for the host record, etc. So yeah there can be some steps involved - now multiple that by how many domains can be on a single website - see my neowin.net example. And yup you can create some dns traffic to be sure..

Example to be able to find www.neowin.net

now I snipped alot of this info out -- but to get the www.neowin.net IP had do these queries

; <<>> DiG 9.2.4 <<>> @4.2.2.2 www.neowin.net +trace

;; Received 228 bytes from 4.2.2.2#53(4.2.2.2) in 1 ms

;; Received 501 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 2 ms

;; Received 100 bytes from 192.41.162.30#53(L.GTLD-SERVERS.net) in 72 ms

;; Received 180 bytes from 209.124.63.212#53(ns1.neowin.net) in 72 ms

Ask for nameservers for .net, then asks .net nameservers for servers for neowin, then ask neowin nameservers for www, etc..

Here is a pretty good write up on how recursion works.

http://www.windowsnetworking.com/articles_tutorials/Understanding-DNS-Recursion.html

So you can see 1 simple query for 1 host record to DNS, generated 3 queries all going to be outbound on 53, etc.

Buts its not really the protocol that is being chatty.. It handles quite a bit of info with very little amount of traffic.. How else would you do recursion with less queries? There has to be some method of looking up who is the owning server of say neowin.net. Its not going to be able to sit in 1 giant database ;)

A Chatty protocol is something that either does a lot of unnecessary advertisement of itself -- ie sending out broadcasts all the time as example.. Or requires alot of back and forth traffic, ie waiting for acknowledgment before transmitting again, etc. CIFS for example has a lot of back and forth traffic, I would say smtp could be seen as chatty, etc. I would not really call dns chatty -- you send a query over udp, it sends you the info back.. Pretty streamlined if you ask me ;)

Problem is recursion, even though the exchange of info is pretty streamlined - you have to ask a few servers how to find the owning server of domainX. Which is where TTLs and caching comes into play.. Once I know this info, I don't have to go ask again until that TTL has expired -- so the next guy asking, I either have the info - or know the IP of the nameserver for domainX already and can ask him directly for a different host vs having to do the full recursion again, etc.

Look up the definition of chatty protocol ;)

DEFINITION - A chatty protocol is an application or routing protocol that requires a client or server to wait for an acknowledgement before it can transmit again. Such protocols are called "chatty" because they require a lot of back-and-forth communication.

Does DNS fit that?

chatty protocol

Home > Library > Technology > Computer Encyclopedia

A network protocol in which servers constantly advertise their availability over the network. The continuous transmission of these additional packets adds to network overhead. See broadcast.

Again does DNS fit that?

Also recursion does not always take place -- in an AD environment looking up servers there is no recursion required, only when asking a server for records it does not own does it take place. If you look at it from the point of view of the owning server -- there is not a lot of chatter. It gets asked for say host www or smtp or ftp, etc. And it answers - one query, one response. very small amounts of data with a lot of info in them, etc.

I agree the definition of chatty is not important to this topic, and I agree with you dns can cause a lot of traffic -- depending ;) But I would not consider it a "chatty" protocol in general.

heheh -- so we are on the same page - I just personally would not call it chatty ;)

No to a better question - do you think we will ever hear back from the OP..

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Why Delta Chat is the best decentralized messenger you have probably never tried by Paul Hill There is no shortage of messaging apps out there; we have WhatsApp, Messenger, and Telegram, just to name a few. While Meta has taken steps to incorporate encryption into Messenger and WhatsApp, they still leave a lot to be desired. If you are in the market for a messaging app that promotes security, privacy, and optional anonymity, you'll want to read what I have to say about Delta Chat. For those not familiar with Delta Chat, rather than relying on centralized servers as you do with Facebook Messenger, it relies on email. Essentially, it is a chat interface that feels like a messaging app, but secretly in the background, it is firing off emails. In the past, you used to have to sign in with your email account. When you sent messages to people, it would just be sending encrypted messages to their inbox, which their Delta Chat client would decrypt. When I first learned about Delta Chat, it required users to sign in with an email account, but I was pleasantly surprised upon trying it in 2026 that this is no longer a requirement, or the preferred method was to use the app. Recently, I’ve tried UAD-ng on my old Nokia 3.4 to disable most of the Google apps because the bootloader is locked, and this is the next best option. While finding replacement apps in F-Droid, I came across Delta Chat again, and it has undergone quite a big change since I last used it, with its new chatmail relays, which no longer require you to sign in to your own email account, providing anonymity, and they offer greater security. Android and Desktop Delta Chat apps. Not only does it run on my de-googled phone, but it also works on desktop computers and iOS, making it truly ubiquitous. For me, Delta Chat is a wonderful alternative messenger because it gives you more control. It supports switching between different profiles, which you can set up super quickly; you don’t register a username, you don’t register a password. The only thing you do have is a random string email address on a chatmail relay (which you don’t have to memorize). To maintain access to your profile, you just need to add a second device to your account via QR code or make a backup of your account, which you can restore later. Fail to do these, your account is gone - as it should be if you don’t want to leave accounts that could get hacked later on. My decision to block Google stuff on my Nokia was done for practical reasons; the device sucked when it launched, and it sucks even more now. The nice thing about F-Droid and the apps within is that they’re usually lightweight, free of bloat, and work well on that device. What was inconvenient for me was that it was hard to send messages from that device, say if I wanted to copy a code over to my main phone or send family members a link from that device. That’s when I decided to look at the available chat apps and saw Delta Chat. Another nice thing about Delta Chat is its notifications. Some messaging apps rely on Google’s ecosystem for notification transport on Android; however, with Delta Chat, it can use Google’s solutions if you have Play Services or MicroG installed. Otherwise, it is able to keep a background connection to the chatmail relay server so that you can get notified when you receive a message. As free software, the code of Delta Chat is open for all who want to take it and build upon it. In the future, if the developers of Delta Chat make a catastrophically bad decision and take the app in an undesirable direction, users can take the code and fork the project. This contrasts with closed-source apps from corporations that can take their products in any direction they like. By relying on free software instead of closed-source programs, you actually control your computing. I’ve spoken at length about how running this type of software is like owning your own home rather than renting it. The same applies here; if you use Delta Chat, you don’t need to worry about it going away in the future. Whether it is Telegram, WhatsApp, or Messenger, you are required to register a username and password to use these services. A major flaw in this design is that anyone can try various passwords and potentially break into your account with your complete chat history intact. Sure, there is encryption in Messenger, where you need a second PIN and two-factor authentication in Telegram, but breaches happen all the time. Unlike before, when you used to sign in to your email account to send and receive messages, the primary way to do it now is to create an account on a chatmail relay. The resulting email address is a random string followed by the name of the relay you pick. This means you can start and begin adding contacts Without a username and password, you either need to ensure you have a backup or at least one device running your Delta Chat profile. The primary way to log in on another device is to go to the settings and add a second device. Then, you’ll just scan a QR code with your new device, and it’ll log in to your account and sync all your chat history and contacts. To end users, Delta Chat just looks like any instant messenger; however, it is really sending your messages as encrypted emails to your contact. This is pretty cool from a censorship perspective, as it makes the service more difficult to block. Previously, the main way to use the app was by logging in with email, but nowadays, it’s recommended that you use chatmail relays. Chatmail relays temporarily hold messages in case your device is offline. They are cheap, simple servers that don’t store data as group states. Other information, like your name and avatar, only exists on your device and the devices of those you share your contact information with. The relays are also decentralized and operated by various groups and individuals. It is even possible to set up your own chatmail relay, but most people will want to use one hosted elsewhere. To keep your messages secure, Delta Chat uses a secure subset of the OpenPGP standard that gives you automatic end-to-end encryption. It also uses Secure-Join to exchange encryption setup information through QR-code scanning or invite links. Autocrypt is also used to automatically establish end-to-end encryption between contacts and all members of group chat, but sometime this year Autocrypt v2 will be rolled out, bringing post-quantum resistant encryption and forward secrecy. The Delta Chat FAQ is an interesting read that explains many more details about the app. Credit: Pexels Delta Chat is unique among messaging apps because it is built on email, a technology that’s decades old and isn’t going anywhere soon. What’s more is that email is not centralized either, so it’s far more difficult for any authoritarian regime to disrupt the Delta Chat app. I haven’t spoken too much about features yet, so I will do that now. Delta Chat allows you to do one-on-one chats, group chats, and create channels. It also supports file sharing and making audio and video calls when chatting one-to-one, but it’s not available for group chats right now. At the time of writing, the calling functionality is disabled and can be enabled in Settings > Advanced > Debug Calls. I have used the video calling feature, and the quality is excellent. It works over WebRTC, another open standard. The app also lets you send voice notes, enables disappearing messages, and has its own app ecosystem. I did try playing chess one time there, but it was a bit spotty; though, we did manage to complete the game with a victory for me. To add people to Delta Chat, you can either give them your Delta Chat link or your QR code to scan. These are the only ways to add users, so you won't have any spam bots bothering you. If the people you want to chat with don't have the app yet, just send them your link, and it will take them to a webpage where they can install the app and then add you. It's really quick for them to install it and get started, which is nice. Credit: Microsoft. The Majorana 2 quantum chip unveiled in 2026. I do not think quantum computers are too far out now, and I do hope that Delta Chat is able to push out Autocrypt v2 sooner, rather than later, so bad actors do not attempt to collect encrypted communications and then decrypt them in the future using quantum computers. By getting people’s messages post-quantum-safe now, users won’t have to worry when quantum computers start cracking legacy encryption. Overall, I would recommend this app to people who are already past WhatsApp and Messenger and have perhaps begun using apps like Telegram or Session. It shares a lot of characteristics with these apps and goes a lot further than Telegram in terms of security. By being based on email, it is also resistant to censorship, and the lack of a username and password makes you anonymous (if you want to be) and safe from brute force password cracking attempts. Let me know in the comments if you’ve tried Delta Chat recently. Do you think it's a good bulwark against governments that are tightening their grip on the internet?
    • Putin was behind Farage/Brexit and behind Trump/MAGA. Different idiot lying beasts, same fascist master. Same screwed up results for both nations.
    • For me the Final Fantasy games, Langrisser I & II, Hardspace: Shipbreaker, Horizon Forbidden West Complete Edition, Metaphor: ReFantazio and LUNAR Remastered Collection
  • Recent Achievements

    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
    • First Post
      OffsetAbs earned a badge
      First Post
    • Reacting Well
      OffsetAbs earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      464
    2. 2
      +Edouard
      217
    3. 3
      PsYcHoKiLLa
      155
    4. 4
      Steven P.
      73
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!