Editor: DNS Flood Detector was developed to Detect abusive usage levels on high traffic nameservers and to enable quick response in halting the use of one's nameserver to facilitate spam.
How does it work?
DNS Flood Detector uses libpcap (in non-promiscuous mode) to monitor incoming dns queries to a nameserver. The tool may be run in one of two modes, either daemon mode or "bindsnap" mode. In daemon mode, the tool will alarm via Syslog. In bindsnap mode, the user is able to get near-real-time stats on usage to aid in more detailed troubleshooting.
Why was it written?
I wrote DNS Flood Detector because the fifty or so public recursive nameservers I am responsible for were being abused by both customers and non-customers. DNS Flood Detector allows for prompt action when anomalous conditions are detected.
What do I need to use it?
You need libpcap and a Little bit of Patience. I have currently tested DNS Flood Detector on Linux, OSX, BSDI, Solaris 9, and FreeBSD.
