llvmのエラーメッセージがわかりやすかった

foo.m_bar と書くべきところを,foo.bar と書いていたら,foo.m_bar なんじゃないのと指摘してくれた.なんだこれは.たまげたなあ.凄い(確信).

こんなかんじで書いていると,

class ssl_info {
public:
    ptr_cdpi_ssl m_client;
};

void func() {
    get_ssl_obj(info.client, b1);
}

このようにエラーを出すのだ.

/home/ytakano/program/c/catenaccio_dpi/src/cdpi_mongo.cpp:394:22: error: no
      member named 'client' in 'my_event_listener::ssl_info'; did you mean
      'm_client'?
    get_ssl_obj(info.client, b1);
                     ^~~~~~
                     m_client
/home/ytakano/program/c/catenaccio_dpi/src/cdpi_mongo.hpp:69:22: note: 
      'm_client' declared here
        ptr_cdpi_ssl m_client;

しかし,emacsllvmのエラーメッセージのパースに失敗してて,エラー行へのジャンプが上手く行かなくて困る.

gccとllvmのコンパイル時間

計測したソースコードはこれ https://github.com/ytakano/catenaccio_dpi

まずは,最適化無し(-g -O0)から.

$ cmake -DCMAKE_CXX_COMPILER=clang++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  43.50s user 3.08s system 99% cpu 46.746 total
$ cmake -DCMAKE_CXX_COMPILER=g++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  61.12s user 4.26s system 99% cpu 1:05.61 total

18秒ぐらいllvmの方が速い.

続いて最適化あり(-O3)の場合.

$ cmake -DCMAKE_CXX_COMPILER=clang++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  53.71s user 2.77s system 99% cpu 56.534 total
$ cmake -DCMAKE_CXX_COMPILER=g++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  87.73s user 4.15s system 99% cpu 1:31.94 total

34秒ぐらいllvmの方が速い.

Observation of DNS Amplification Attack (krasti.us)


$ dig @::1 krasti.us any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 krasti.us any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44376
;; flags: qr rd ra; QUERY: 1, ANSWER: 35, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;krasti.us.			IN	ANY

;; ANSWER SECTION:
krasti.us.		600	IN	A	184.168.221.51
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksuckssucksuck.com.
krasti.us.		604800	IN	MX	21 lolwutevet2.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksuscksuck.com.
krasti.us.		604800	IN	MX	22 lolwutevet3.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksuckncsucksuck.com.
krasti.us.		604800	IN	MX	23 lolwutevet4.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucnksucksuck.com.
krasti.us.		604800	IN	MX	24 lolwutevet5.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksu0cksucksuck.com.
krasti.us.		604800	IN	MX	26 lolwutevet8.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresuck8sucksucksuck.com.
krasti.us.		604800	IN	MX	28 lolwutevet0.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresuc7ksucksucksuck.com.
krasti.us.		604800	IN	MX	29 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouares6ucksucksucksuck.com.
krasti.us.		604800	IN	MX	30 lolwutevet23.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouare5sucksucksucksuck.com.
krasti.us.		604800	IN	MX	32 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouar4esucksucksucksuck.com.
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyou3aresucksucksucksuck.com.
krasti.us.		604800	IN	MX	21 lolwutevet2.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyoua2resucksucksucksuck.com.
krasti.us.		604800	IN	MX	22 lolwutevet3.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyou1aresucksucksucksuxck.com.
krasti.us.		604800	IN	MX	23 lolwutevet4.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucknbsuxck.com.
krasti.us.		604800	IN	MX	24 lolwutevet5.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuck.com.
krasti.us.		604800	IN	MX	26 lolwutevet8.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksugck.com.
krasti.us.		604800	IN	MX	28 lolwutevet0.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksuckgsuck.com.
krasti.us.		604800	IN	MX	29 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksgucksuck.com.
krasti.us.		604800	IN	MX	30 lolwutevet23.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucgknsuck.com.
krasti.us.		604800	IN	MX	32 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckn.com.
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksucdk.com.
krasti.us.		604800	IN	MX	21 lolwutevet2.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckd.com.
krasti.us.		604800	IN	MX	22 lolwutevet3.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksugckd.com.
krasti.us.		604800	IN	MX	23 lolwutevet4.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckn.com.
krasti.us.		604800	IN	MX	24 lolwutevet5.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckg.com.
krasti.us.		604800	IN	MX	26 lolwutevet8.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckg.com.
krasti.us.		604800	IN	MX	28 lolwutevet0.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckg.com.
krasti.us.		604800	IN	MX	30 lolwutevet23.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckf.com.
krasti.us.		604800	IN	MX	32 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksucku.com.
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuck.com.
krasti.us.		3600	IN	NS	ns09.domaincontrol.com.
krasti.us.		3600	IN	NS	ns10.domaincontrol.com.
krasti.us.		604800	IN	TXT	"sdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdasssdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasd" "assdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdasdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasdassdasd" "assdasdassdasdassdasdassdasdassdasdassdasdassdaasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasdassdasdassda" "sdassdasdassdasdassdasdassdasdassdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasdassdasdassdasdassdasdassdasdassd" "asda"
krasti.us.		3600	IN	SOA	ns09.domaincontrol.com. dns.jomax.net. 2013102200 28800 7200 604800 600

;; Query time: 8 msec
;; SERVER: ::1#53(::1)
;; WHEN: Wed Oct 23 18:04:24 JST 2013
;; MSG SIZE  rcvd: 4886
$ dig @::1 krasti.us ns

; <<>> DiG 9.8.5-P1 <<>> @::1 krasti.us ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62904
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;krasti.us.			IN	NS

;; ANSWER SECTION:
krasti.us.		3526	IN	NS	ns09.domaincontrol.com.
krasti.us.		3526	IN	NS	ns10.domaincontrol.com.

;; Query time: 171 msec
;; SERVER: ::1#53(::1)
;; WHEN: Wed Oct 23 18:05:38 JST 2013
;; MSG SIZE  rcvd: 82
ns09.domaincontrol.com.	71506	IN	A	216.69.185.5
ns10.domaincontrol.com.	71502	IN	A	208.109.255.5
$ whois 216.69.185.5

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 216.69.185.5"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=216.69.185.5?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       216.69.128.0 - 216.69.191.255
CIDR:           216.69.128.0/18
OriginAS:
NetName:        GO-DADDY-COM-LLC
NetHandle:      NET-216-69-128-0-1
Parent:         NET-216-0-0-0-0
NetType:        Direct Allocation
RegDate:        2004-05-24
Updated:        2012-02-24
Ref:            http://whois.arin.net/rest/net/NET-216-69-128-0-1

OrgName:        GoDaddy.com, LLC
OrgId:          GODAD
Address:        14455 N Hayden Road
Address:        Suite 226
City:           Scottsdale
StateProv:      AZ
PostalCode:     85260
Country:        US
RegDate:        2007-06-01
Updated:        2012-03-15
Comment:        Please send abuse complaints to abuse@godaddy.com
Ref:            http://whois.arin.net/rest/org/GODAD

OrgAbuseHandle: ABUSE51-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-480-624-2505
OrgAbuseEmail:  abuse@godaddy.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE51-ARIN

OrgNOCHandle: NOC124-ARIN
OrgNOCName:   Network Operations Center
OrgNOCPhone:  +1-480-505-8809
OrgNOCEmail:  noc@godaddy.com
OrgNOCRef:    http://whois.arin.net/rest/poc/NOC124-ARIN

OrgTechHandle: NOC124-ARIN
OrgTechName:   Network Operations Center
OrgTechPhone:  +1-480-505-8809
OrgTechEmail:  noc@godaddy.com
OrgTechRef:    http://whois.arin.net/rest/poc/NOC124-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html

Observation of DNS Amplification Attack (txt.fwserver.com.ua)


$ dig @::1 txt.fwserver.com.ua any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 txt.fwserver.com.ua any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35790
;; flags: qr rd ra; QUERY: 1, ANSWER: 244, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;txt.fwserver.com.ua.		IN	ANY

;; ANSWER SECTION:
txt.fwserver.com.ua.	28800	IN	SOA	ns1.ua-dc.net. root.ua-dc.net. 2013090211 28800 7200 1209600 2600
txt.fwserver.com.ua.	28800	IN	NS	ns1.ua-dc.net.
txt.fwserver.com.ua.	28800	IN	NS	ns2.ua-dc.net.
txt.fwserver.com.ua.	28800	IN	A	204.46.43.140
txt.fwserver.com.ua.	28800	IN	A	204.46.43.141
txt.fwserver.com.ua.	28800	IN	A	204.46.43.142
txt.fwserver.com.ua.	28800	IN	A	204.46.43.143
txt.fwserver.com.ua.	28800	IN	A	204.46.43.144
txt.fwserver.com.ua.	28800	IN	A	204.46.43.145
txt.fwserver.com.ua.	28800	IN	A	204.46.43.146
txt.fwserver.com.ua.	28800	IN	A	204.46.43.147
txt.fwserver.com.ua.	28800	IN	A	204.46.43.148
txt.fwserver.com.ua.	28800	IN	A	204.46.43.149
txt.fwserver.com.ua.	28800	IN	A	204.46.43.150
txt.fwserver.com.ua.	28800	IN	A	204.46.43.151
txt.fwserver.com.ua.	28800	IN	A	204.46.43.152
txt.fwserver.com.ua.	28800	IN	A	204.46.43.153
txt.fwserver.com.ua.	28800	IN	A	204.46.43.154
txt.fwserver.com.ua.	28800	IN	A	204.46.43.155
txt.fwserver.com.ua.	28800	IN	A	204.46.43.156
txt.fwserver.com.ua.	28800	IN	A	204.46.43.157
txt.fwserver.com.ua.	28800	IN	A	204.46.43.158
txt.fwserver.com.ua.	28800	IN	A	204.46.43.159
txt.fwserver.com.ua.	28800	IN	A	204.46.43.160
txt.fwserver.com.ua.	28800	IN	A	204.46.43.161
txt.fwserver.com.ua.	28800	IN	A	204.46.43.162
txt.fwserver.com.ua.	28800	IN	A	204.46.43.163
txt.fwserver.com.ua.	28800	IN	A	204.46.43.164
txt.fwserver.com.ua.	28800	IN	A	204.46.43.165
txt.fwserver.com.ua.	28800	IN	A	204.46.43.166
txt.fwserver.com.ua.	28800	IN	A	204.46.43.167
txt.fwserver.com.ua.	28800	IN	A	204.46.43.168
txt.fwserver.com.ua.	28800	IN	A	204.46.43.169
txt.fwserver.com.ua.	28800	IN	A	204.46.43.170
txt.fwserver.com.ua.	28800	IN	A	204.46.43.171
txt.fwserver.com.ua.	28800	IN	A	204.46.43.172
txt.fwserver.com.ua.	28800	IN	A	204.46.43.173
txt.fwserver.com.ua.	28800	IN	A	204.46.43.174
txt.fwserver.com.ua.	28800	IN	A	204.46.43.175
txt.fwserver.com.ua.	28800	IN	A	204.46.43.176
txt.fwserver.com.ua.	28800	IN	A	204.46.43.177
txt.fwserver.com.ua.	28800	IN	A	204.46.43.178
txt.fwserver.com.ua.	28800	IN	A	204.46.43.179
txt.fwserver.com.ua.	28800	IN	A	204.46.43.180
txt.fwserver.com.ua.	28800	IN	A	204.46.43.181
txt.fwserver.com.ua.	28800	IN	A	204.46.43.182
txt.fwserver.com.ua.	28800	IN	A	204.46.43.183
txt.fwserver.com.ua.	28800	IN	A	204.46.43.184
txt.fwserver.com.ua.	28800	IN	A	204.46.43.185
txt.fwserver.com.ua.	28800	IN	A	204.46.43.186
txt.fwserver.com.ua.	28800	IN	A	204.46.43.187
txt.fwserver.com.ua.	28800	IN	A	204.46.43.188
txt.fwserver.com.ua.	28800	IN	A	204.46.43.189
txt.fwserver.com.ua.	28800	IN	A	204.46.43.190
txt.fwserver.com.ua.	28800	IN	A	204.46.43.191
txt.fwserver.com.ua.	28800	IN	A	204.46.43.192
txt.fwserver.com.ua.	28800	IN	A	204.46.43.193
txt.fwserver.com.ua.	28800	IN	A	204.46.43.194
txt.fwserver.com.ua.	28800	IN	A	204.46.43.195
txt.fwserver.com.ua.	28800	IN	A	204.46.43.196
txt.fwserver.com.ua.	28800	IN	A	204.46.43.197
txt.fwserver.com.ua.	28800	IN	A	204.46.43.198
txt.fwserver.com.ua.	28800	IN	A	204.46.43.199
txt.fwserver.com.ua.	28800	IN	A	204.46.43.200
txt.fwserver.com.ua.	28800	IN	A	204.46.43.201
txt.fwserver.com.ua.	28800	IN	A	204.46.43.202
txt.fwserver.com.ua.	28800	IN	A	204.46.43.203
txt.fwserver.com.ua.	28800	IN	A	204.46.43.204
txt.fwserver.com.ua.	28800	IN	A	204.46.43.205
txt.fwserver.com.ua.	28800	IN	A	204.46.43.206
txt.fwserver.com.ua.	28800	IN	A	204.46.43.207
txt.fwserver.com.ua.	28800	IN	A	204.46.43.208
txt.fwserver.com.ua.	28800	IN	A	204.46.43.209
txt.fwserver.com.ua.	28800	IN	A	204.46.43.210
txt.fwserver.com.ua.	28800	IN	A	204.46.43.211
txt.fwserver.com.ua.	28800	IN	A	204.46.43.212
txt.fwserver.com.ua.	28800	IN	A	204.46.43.213
txt.fwserver.com.ua.	28800	IN	A	204.46.43.214
txt.fwserver.com.ua.	28800	IN	A	204.46.43.215
txt.fwserver.com.ua.	28800	IN	A	204.46.43.216
txt.fwserver.com.ua.	28800	IN	A	204.46.43.217
txt.fwserver.com.ua.	28800	IN	A	204.46.43.218
txt.fwserver.com.ua.	28800	IN	A	204.46.43.219
txt.fwserver.com.ua.	28800	IN	A	204.46.43.220
txt.fwserver.com.ua.	28800	IN	A	204.46.43.221
txt.fwserver.com.ua.	28800	IN	A	204.46.43.222
txt.fwserver.com.ua.	28800	IN	A	204.46.43.223
txt.fwserver.com.ua.	28800	IN	A	204.46.43.224
txt.fwserver.com.ua.	28800	IN	A	204.46.43.225
txt.fwserver.com.ua.	28800	IN	A	204.46.43.226
txt.fwserver.com.ua.	28800	IN	A	204.46.43.227
txt.fwserver.com.ua.	28800	IN	A	204.46.43.228
txt.fwserver.com.ua.	28800	IN	A	204.46.43.229
txt.fwserver.com.ua.	28800	IN	A	204.46.43.230
txt.fwserver.com.ua.	28800	IN	A	204.46.43.231
txt.fwserver.com.ua.	28800	IN	A	204.46.43.232
txt.fwserver.com.ua.	28800	IN	A	204.46.43.233
txt.fwserver.com.ua.	28800	IN	A	204.46.43.234
txt.fwserver.com.ua.	28800	IN	A	204.46.43.235
txt.fwserver.com.ua.	28800	IN	A	204.46.43.236
txt.fwserver.com.ua.	28800	IN	A	204.46.43.237
txt.fwserver.com.ua.	28800	IN	A	204.46.43.238
txt.fwserver.com.ua.	28800	IN	A	204.46.43.239
txt.fwserver.com.ua.	28800	IN	A	204.46.43.240
txt.fwserver.com.ua.	28800	IN	A	91.212.124.2
txt.fwserver.com.ua.	28800	IN	A	204.46.43.1
txt.fwserver.com.ua.	28800	IN	A	204.46.43.2
txt.fwserver.com.ua.	28800	IN	A	204.46.43.3
txt.fwserver.com.ua.	28800	IN	A	204.46.43.4
txt.fwserver.com.ua.	28800	IN	A	204.46.43.5
txt.fwserver.com.ua.	28800	IN	A	204.46.43.6
txt.fwserver.com.ua.	28800	IN	A	204.46.43.7
txt.fwserver.com.ua.	28800	IN	A	204.46.43.8
txt.fwserver.com.ua.	28800	IN	A	204.46.43.9
txt.fwserver.com.ua.	28800	IN	A	204.46.43.10
txt.fwserver.com.ua.	28800	IN	A	204.46.43.11
txt.fwserver.com.ua.	28800	IN	A	204.46.43.12
txt.fwserver.com.ua.	28800	IN	A	204.46.43.13
txt.fwserver.com.ua.	28800	IN	A	204.46.43.14
txt.fwserver.com.ua.	28800	IN	A	204.46.43.15
txt.fwserver.com.ua.	28800	IN	A	204.46.43.16
txt.fwserver.com.ua.	28800	IN	A	204.46.43.17
txt.fwserver.com.ua.	28800	IN	A	204.46.43.18
txt.fwserver.com.ua.	28800	IN	A	204.46.43.19
txt.fwserver.com.ua.	28800	IN	A	204.46.43.20
txt.fwserver.com.ua.	28800	IN	A	204.46.43.21
txt.fwserver.com.ua.	28800	IN	A	204.46.43.22
txt.fwserver.com.ua.	28800	IN	A	204.46.43.23
txt.fwserver.com.ua.	28800	IN	A	204.46.43.24
txt.fwserver.com.ua.	28800	IN	A	204.46.43.25
txt.fwserver.com.ua.	28800	IN	A	204.46.43.26
txt.fwserver.com.ua.	28800	IN	A	204.46.43.27
txt.fwserver.com.ua.	28800	IN	A	204.46.43.28
txt.fwserver.com.ua.	28800	IN	A	204.46.43.29
txt.fwserver.com.ua.	28800	IN	A	204.46.43.30
txt.fwserver.com.ua.	28800	IN	A	204.46.43.31
txt.fwserver.com.ua.	28800	IN	A	204.46.43.32
txt.fwserver.com.ua.	28800	IN	A	204.46.43.33
txt.fwserver.com.ua.	28800	IN	A	204.46.43.34
txt.fwserver.com.ua.	28800	IN	A	204.46.43.35
txt.fwserver.com.ua.	28800	IN	A	204.46.43.36
txt.fwserver.com.ua.	28800	IN	A	204.46.43.37
txt.fwserver.com.ua.	28800	IN	A	204.46.43.38
txt.fwserver.com.ua.	28800	IN	A	204.46.43.39
txt.fwserver.com.ua.	28800	IN	A	204.46.43.40
txt.fwserver.com.ua.	28800	IN	A	204.46.43.41
txt.fwserver.com.ua.	28800	IN	A	204.46.43.42
txt.fwserver.com.ua.	28800	IN	A	204.46.43.43
txt.fwserver.com.ua.	28800	IN	A	204.46.43.44
txt.fwserver.com.ua.	28800	IN	A	204.46.43.45
txt.fwserver.com.ua.	28800	IN	A	204.46.43.46
txt.fwserver.com.ua.	28800	IN	A	204.46.43.47
txt.fwserver.com.ua.	28800	IN	A	204.46.43.48
txt.fwserver.com.ua.	28800	IN	A	204.46.43.49
txt.fwserver.com.ua.	28800	IN	A	204.46.43.50
txt.fwserver.com.ua.	28800	IN	A	204.46.43.51
txt.fwserver.com.ua.	28800	IN	A	204.46.43.52
txt.fwserver.com.ua.	28800	IN	A	204.46.43.53
txt.fwserver.com.ua.	28800	IN	A	204.46.43.54
txt.fwserver.com.ua.	28800	IN	A	204.46.43.55
txt.fwserver.com.ua.	28800	IN	A	204.46.43.56
txt.fwserver.com.ua.	28800	IN	A	204.46.43.57
txt.fwserver.com.ua.	28800	IN	A	204.46.43.58
txt.fwserver.com.ua.	28800	IN	A	204.46.43.59
txt.fwserver.com.ua.	28800	IN	A	204.46.43.60
txt.fwserver.com.ua.	28800	IN	A	204.46.43.61
txt.fwserver.com.ua.	28800	IN	A	204.46.43.62
txt.fwserver.com.ua.	28800	IN	A	204.46.43.63
txt.fwserver.com.ua.	28800	IN	A	204.46.43.64
txt.fwserver.com.ua.	28800	IN	A	204.46.43.65
txt.fwserver.com.ua.	28800	IN	A	204.46.43.66
txt.fwserver.com.ua.	28800	IN	A	204.46.43.67
txt.fwserver.com.ua.	28800	IN	A	204.46.43.68
txt.fwserver.com.ua.	28800	IN	A	204.46.43.69
txt.fwserver.com.ua.	28800	IN	A	204.46.43.70
txt.fwserver.com.ua.	28800	IN	A	204.46.43.71
txt.fwserver.com.ua.	28800	IN	A	204.46.43.72
txt.fwserver.com.ua.	28800	IN	A	204.46.43.73
txt.fwserver.com.ua.	28800	IN	A	204.46.43.74
txt.fwserver.com.ua.	28800	IN	A	204.46.43.75
txt.fwserver.com.ua.	28800	IN	A	204.46.43.76
txt.fwserver.com.ua.	28800	IN	A	204.46.43.77
txt.fwserver.com.ua.	28800	IN	A	204.46.43.78
txt.fwserver.com.ua.	28800	IN	A	204.46.43.79
txt.fwserver.com.ua.	28800	IN	A	204.46.43.80
txt.fwserver.com.ua.	28800	IN	A	204.46.43.81
txt.fwserver.com.ua.	28800	IN	A	204.46.43.82
txt.fwserver.com.ua.	28800	IN	A	204.46.43.83
txt.fwserver.com.ua.	28800	IN	A	204.46.43.84
txt.fwserver.com.ua.	28800	IN	A	204.46.43.85
txt.fwserver.com.ua.	28800	IN	A	204.46.43.86
txt.fwserver.com.ua.	28800	IN	A	204.46.43.87
txt.fwserver.com.ua.	28800	IN	A	204.46.43.88
txt.fwserver.com.ua.	28800	IN	A	204.46.43.89
txt.fwserver.com.ua.	28800	IN	A	204.46.43.90
txt.fwserver.com.ua.	28800	IN	A	204.46.43.91
txt.fwserver.com.ua.	28800	IN	A	204.46.43.92
txt.fwserver.com.ua.	28800	IN	A	204.46.43.93
txt.fwserver.com.ua.	28800	IN	A	204.46.43.94
txt.fwserver.com.ua.	28800	IN	A	204.46.43.95
txt.fwserver.com.ua.	28800	IN	A	204.46.43.96
txt.fwserver.com.ua.	28800	IN	A	204.46.43.97
txt.fwserver.com.ua.	28800	IN	A	204.46.43.98
txt.fwserver.com.ua.	28800	IN	A	204.46.43.99
txt.fwserver.com.ua.	28800	IN	A	204.46.43.100
txt.fwserver.com.ua.	28800	IN	A	204.46.43.101
txt.fwserver.com.ua.	28800	IN	A	204.46.43.102
txt.fwserver.com.ua.	28800	IN	A	204.46.43.103
txt.fwserver.com.ua.	28800	IN	A	204.46.43.104
txt.fwserver.com.ua.	28800	IN	A	204.46.43.105
txt.fwserver.com.ua.	28800	IN	A	204.46.43.106
txt.fwserver.com.ua.	28800	IN	A	204.46.43.107
txt.fwserver.com.ua.	28800	IN	A	204.46.43.108
txt.fwserver.com.ua.	28800	IN	A	204.46.43.109
txt.fwserver.com.ua.	28800	IN	A	204.46.43.110
txt.fwserver.com.ua.	28800	IN	A	204.46.43.111
txt.fwserver.com.ua.	28800	IN	A	204.46.43.112
txt.fwserver.com.ua.	28800	IN	A	204.46.43.113
txt.fwserver.com.ua.	28800	IN	A	204.46.43.114
txt.fwserver.com.ua.	28800	IN	A	204.46.43.115
txt.fwserver.com.ua.	28800	IN	A	204.46.43.116
txt.fwserver.com.ua.	28800	IN	A	204.46.43.117
txt.fwserver.com.ua.	28800	IN	A	204.46.43.118
txt.fwserver.com.ua.	28800	IN	A	204.46.43.119
txt.fwserver.com.ua.	28800	IN	A	204.46.43.120
txt.fwserver.com.ua.	28800	IN	A	204.46.43.121
txt.fwserver.com.ua.	28800	IN	A	204.46.43.122
txt.fwserver.com.ua.	28800	IN	A	204.46.43.123
txt.fwserver.com.ua.	28800	IN	A	204.46.43.124
txt.fwserver.com.ua.	28800	IN	A	204.46.43.125
txt.fwserver.com.ua.	28800	IN	A	204.46.43.126
txt.fwserver.com.ua.	28800	IN	A	204.46.43.127
txt.fwserver.com.ua.	28800	IN	A	204.46.43.128
txt.fwserver.com.ua.	28800	IN	A	204.46.43.129
txt.fwserver.com.ua.	28800	IN	A	204.46.43.130
txt.fwserver.com.ua.	28800	IN	A	204.46.43.131
txt.fwserver.com.ua.	28800	IN	A	204.46.43.132
txt.fwserver.com.ua.	28800	IN	A	204.46.43.133
txt.fwserver.com.ua.	28800	IN	A	204.46.43.134
txt.fwserver.com.ua.	28800	IN	A	204.46.43.135
txt.fwserver.com.ua.	28800	IN	A	204.46.43.136
txt.fwserver.com.ua.	28800	IN	A	204.46.43.137
txt.fwserver.com.ua.	28800	IN	A	204.46.43.138
txt.fwserver.com.ua.	28800	IN	A	204.46.43.139

;; Query time: 10 msec
;; SERVER: ::1#53(::1)
;; WHEN: Tue Oct 22 18:56:46 JST 2013
;; MSG SIZE  rcvd: 3979
$ whois 91.212.124.5

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 91.212.124.5"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=91.212.124.5?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       91.0.0.0 - 91.255.255.255
CIDR:           91.0.0.0/8
OriginAS:
NetName:        91-RIPE
NetHandle:      NET-91-0-0-0-1
Parent:
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:        2005-06-30
Updated:        2009-05-18
Ref:            http://whois.arin.net/rest/net/NET-91-0-0-0-1

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            http://whois.arin.net/rest/org/RIPE

ReferralServer: whois://whois.ripe.net:43

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ripe.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ripe.net
OrgTechRef:    http://whois.arin.net/rest/poc/RNO29-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '91.212.124.0 - 91.212.124.255'

inetnum:        91.212.124.0 - 91.212.124.255
netname:        AN-NET
descr:          Nikultsev Aleksandr Nikolaevich
country:        UA
org:            ORG-AN36-RIPE
admin-c:        ANN80-RIPE
tech-c:         ANN80-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-lower:      RIPE-NCC-END-MNT
mnt-by:         MNT-AN
mnt-routes:     MNT-AN
mnt-domains:    MNT-AN
source:         RIPE # Filtered

organisation:   ORG-AN36-RIPE
org-name:       Nikultsev Aleksandr Nikolaevich
org-type:       OTHER
address:        11/22, Sherbiny str.
address:        Dnepropetrovsk, Ukraine
phone:          +380 95 5852446
mnt-ref:        MNT-AN
mnt-by:         MNT-AN
source:         RIPE # Filtered

person:         Alexander Nikultsev
address:        49130, Ukraine, Dniepropetrovsk, Sherbiny str 11/22
phone:          +380 95 5852446
nic-hdl:        ANN80-RIPE
source:         RIPE # Filtered
mnt-by:         MNT-AN

% Information related to '91.212.124.0/24AS49089'

route:          91.212.124.0/24
descr:          UA-DC
mnt-routes:     MNT-AN
origin:         AS49089
mnt-by:         MNT-AN
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.69 (WHOIS4)

Observation of DNS Amplification Attack (pipcvsemnaher.com)

NSs of pipcvsemnaher.com are same as NSs of zaikapaika.com and babywow.co.uk I observed before.

http://d.hatena.ne.jp/ytakano/20131011/1381507516

$ dig @::1 pipcvsemnaher.com any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 pipcvsemnaher.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52244
;; flags: qr rd ra; QUERY: 1, ANSWER: 245, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;pipcvsemnaher.com.		IN	ANY

;; ANSWER SECTION:
pipcvsemnaher.com.	10646	IN	NS	b.dns.gandi.net.
pipcvsemnaher.com.	10646	IN	NS	a.dns.gandi.net.
pipcvsemnaher.com.	10646	IN	NS	c.dns.gandi.net.
pipcvsemnaher.com.	10646	IN	A	204.46.43.64
pipcvsemnaher.com.	10646	IN	A	204.46.43.65
pipcvsemnaher.com.	10646	IN	A	204.46.43.66
pipcvsemnaher.com.	10646	IN	A	204.46.43.67
pipcvsemnaher.com.	10646	IN	A	204.46.43.68
pipcvsemnaher.com.	10646	IN	A	204.46.43.69
pipcvsemnaher.com.	10646	IN	A	204.46.43.70
pipcvsemnaher.com.	10646	IN	A	204.46.43.71
pipcvsemnaher.com.	10646	IN	A	204.46.43.72
pipcvsemnaher.com.	10646	IN	A	204.46.43.73
pipcvsemnaher.com.	10646	IN	A	204.46.43.74
pipcvsemnaher.com.	10646	IN	A	204.46.43.75
pipcvsemnaher.com.	10646	IN	A	204.46.43.76
pipcvsemnaher.com.	10646	IN	A	204.46.43.77
pipcvsemnaher.com.	10646	IN	A	204.46.43.78
pipcvsemnaher.com.	10646	IN	A	204.46.43.79
pipcvsemnaher.com.	10646	IN	A	204.46.43.80
pipcvsemnaher.com.	10646	IN	A	204.46.43.81
pipcvsemnaher.com.	10646	IN	A	204.46.43.82
pipcvsemnaher.com.	10646	IN	A	204.46.43.83
pipcvsemnaher.com.	10646	IN	A	204.46.43.84
pipcvsemnaher.com.	10646	IN	A	204.46.43.85
pipcvsemnaher.com.	10646	IN	A	204.46.43.86
pipcvsemnaher.com.	10646	IN	A	204.46.43.87
pipcvsemnaher.com.	10646	IN	A	204.46.43.88
pipcvsemnaher.com.	10646	IN	A	204.46.43.89
pipcvsemnaher.com.	10646	IN	A	204.46.43.90
pipcvsemnaher.com.	10646	IN	A	204.46.43.91
pipcvsemnaher.com.	10646	IN	A	204.46.43.92
pipcvsemnaher.com.	10646	IN	A	204.46.43.93
pipcvsemnaher.com.	10646	IN	A	204.46.43.94
pipcvsemnaher.com.	10646	IN	A	204.46.43.95
pipcvsemnaher.com.	10646	IN	A	204.46.43.96
pipcvsemnaher.com.	10646	IN	A	204.46.43.97
pipcvsemnaher.com.	10646	IN	A	204.46.43.98
pipcvsemnaher.com.	10646	IN	A	204.46.43.99
pipcvsemnaher.com.	10646	IN	A	204.46.43.100
pipcvsemnaher.com.	10646	IN	A	204.46.43.101
pipcvsemnaher.com.	10646	IN	A	204.46.43.102
pipcvsemnaher.com.	10646	IN	A	204.46.43.103
pipcvsemnaher.com.	10646	IN	A	204.46.43.104
pipcvsemnaher.com.	10646	IN	A	204.46.43.105
pipcvsemnaher.com.	10646	IN	A	204.46.43.106
pipcvsemnaher.com.	10646	IN	A	204.46.43.107
pipcvsemnaher.com.	10646	IN	A	204.46.43.108
pipcvsemnaher.com.	10646	IN	A	204.46.43.109
pipcvsemnaher.com.	10646	IN	A	204.46.43.110
pipcvsemnaher.com.	10646	IN	A	204.46.43.111
pipcvsemnaher.com.	10646	IN	A	204.46.43.112
pipcvsemnaher.com.	10646	IN	A	204.46.43.113
pipcvsemnaher.com.	10646	IN	A	204.46.43.114
pipcvsemnaher.com.	10646	IN	A	204.46.43.115
pipcvsemnaher.com.	10646	IN	A	204.46.43.116
pipcvsemnaher.com.	10646	IN	A	204.46.43.117
pipcvsemnaher.com.	10646	IN	A	204.46.43.118
pipcvsemnaher.com.	10646	IN	A	204.46.43.119
pipcvsemnaher.com.	10646	IN	A	204.46.43.120
pipcvsemnaher.com.	10646	IN	A	204.46.43.121
pipcvsemnaher.com.	10646	IN	A	204.46.43.122
pipcvsemnaher.com.	10646	IN	A	204.46.43.123
pipcvsemnaher.com.	10646	IN	A	204.46.43.124
pipcvsemnaher.com.	10646	IN	A	204.46.43.125
pipcvsemnaher.com.	10646	IN	A	204.46.43.126
pipcvsemnaher.com.	10646	IN	A	204.46.43.127
pipcvsemnaher.com.	10646	IN	A	204.46.43.128
pipcvsemnaher.com.	10646	IN	A	204.46.43.129
pipcvsemnaher.com.	10646	IN	A	204.46.43.130
pipcvsemnaher.com.	10646	IN	A	204.46.43.131
pipcvsemnaher.com.	10646	IN	A	204.46.43.132
pipcvsemnaher.com.	10646	IN	A	204.46.43.133
pipcvsemnaher.com.	10646	IN	A	204.46.43.134
pipcvsemnaher.com.	10646	IN	A	204.46.43.135
pipcvsemnaher.com.	10646	IN	A	204.46.43.137
pipcvsemnaher.com.	10646	IN	A	204.46.43.138
pipcvsemnaher.com.	10646	IN	A	204.46.43.139
pipcvsemnaher.com.	10646	IN	A	204.46.43.140
pipcvsemnaher.com.	10646	IN	A	204.46.43.141
pipcvsemnaher.com.	10646	IN	A	204.46.43.142
pipcvsemnaher.com.	10646	IN	A	204.46.43.143
pipcvsemnaher.com.	10646	IN	A	204.46.43.144
pipcvsemnaher.com.	10646	IN	A	204.46.43.145
pipcvsemnaher.com.	10646	IN	A	204.46.43.146
pipcvsemnaher.com.	10646	IN	A	204.46.43.147
pipcvsemnaher.com.	10646	IN	A	204.46.43.148
pipcvsemnaher.com.	10646	IN	A	204.46.43.149
pipcvsemnaher.com.	10646	IN	A	204.46.43.150
pipcvsemnaher.com.	10646	IN	A	204.46.43.151
pipcvsemnaher.com.	10646	IN	A	204.46.43.152
pipcvsemnaher.com.	10646	IN	A	204.46.43.153
pipcvsemnaher.com.	10646	IN	A	204.46.43.154
pipcvsemnaher.com.	10646	IN	A	204.46.43.155
pipcvsemnaher.com.	10646	IN	A	204.46.43.156
pipcvsemnaher.com.	10646	IN	A	204.46.43.157
pipcvsemnaher.com.	10646	IN	A	204.46.43.158
pipcvsemnaher.com.	10646	IN	A	204.46.43.159
pipcvsemnaher.com.	10646	IN	A	204.46.43.160
pipcvsemnaher.com.	10646	IN	A	204.46.43.161
pipcvsemnaher.com.	10646	IN	A	204.46.43.162
pipcvsemnaher.com.	10646	IN	A	204.46.43.163
pipcvsemnaher.com.	10646	IN	A	204.46.43.164
pipcvsemnaher.com.	10646	IN	A	204.46.43.165
pipcvsemnaher.com.	10646	IN	A	204.46.43.166
pipcvsemnaher.com.	10646	IN	A	204.46.43.167
pipcvsemnaher.com.	10646	IN	A	204.46.43.168
pipcvsemnaher.com.	10646	IN	A	204.46.43.169
pipcvsemnaher.com.	10646	IN	A	204.46.43.170
pipcvsemnaher.com.	10646	IN	A	204.46.43.171
pipcvsemnaher.com.	10646	IN	A	204.46.43.172
pipcvsemnaher.com.	10646	IN	A	204.46.43.173
pipcvsemnaher.com.	10646	IN	A	204.46.43.174
pipcvsemnaher.com.	10646	IN	A	204.46.43.175
pipcvsemnaher.com.	10646	IN	A	204.46.43.176
pipcvsemnaher.com.	10646	IN	A	204.46.43.177
pipcvsemnaher.com.	10646	IN	A	204.46.43.178
pipcvsemnaher.com.	10646	IN	A	204.46.43.179
pipcvsemnaher.com.	10646	IN	A	204.46.43.180
pipcvsemnaher.com.	10646	IN	A	204.46.43.181
pipcvsemnaher.com.	10646	IN	A	204.46.43.182
pipcvsemnaher.com.	10646	IN	A	204.46.43.183
pipcvsemnaher.com.	10646	IN	A	204.46.43.184
pipcvsemnaher.com.	10646	IN	A	204.46.43.185
pipcvsemnaher.com.	10646	IN	A	204.46.43.186
pipcvsemnaher.com.	10646	IN	A	204.46.43.187
pipcvsemnaher.com.	10646	IN	A	204.46.43.188
pipcvsemnaher.com.	10646	IN	A	204.46.43.189
pipcvsemnaher.com.	10646	IN	A	204.46.43.190
pipcvsemnaher.com.	10646	IN	A	204.46.43.191
pipcvsemnaher.com.	10646	IN	A	204.46.43.19
pipcvsemnaher.com.	10646	IN	A	204.46.43.192
pipcvsemnaher.com.	10646	IN	A	204.46.43.193
pipcvsemnaher.com.	10646	IN	A	204.46.43.194
pipcvsemnaher.com.	10646	IN	A	204.46.43.195
pipcvsemnaher.com.	10646	IN	A	204.46.43.196
pipcvsemnaher.com.	10646	IN	A	204.46.43.197
pipcvsemnaher.com.	10646	IN	A	204.46.43.198
pipcvsemnaher.com.	10646	IN	A	204.46.43.199
pipcvsemnaher.com.	10646	IN	A	204.46.43.200
pipcvsemnaher.com.	10646	IN	A	204.46.43.201
pipcvsemnaher.com.	10646	IN	A	204.46.43.202
pipcvsemnaher.com.	10646	IN	A	204.46.43.203
pipcvsemnaher.com.	10646	IN	A	204.46.43.204
pipcvsemnaher.com.	10646	IN	A	204.46.43.205
pipcvsemnaher.com.	10646	IN	A	204.46.43.206
pipcvsemnaher.com.	10646	IN	A	204.46.43.207
pipcvsemnaher.com.	10646	IN	A	204.46.43.208
pipcvsemnaher.com.	10646	IN	A	204.46.43.209
pipcvsemnaher.com.	10646	IN	A	204.46.43.210
pipcvsemnaher.com.	10646	IN	A	204.46.43.211
pipcvsemnaher.com.	10646	IN	A	204.46.43.212
pipcvsemnaher.com.	10646	IN	A	204.46.43.213
pipcvsemnaher.com.	10646	IN	A	204.46.43.214
pipcvsemnaher.com.	10646	IN	A	204.46.43.215
pipcvsemnaher.com.	10646	IN	A	204.46.43.216
pipcvsemnaher.com.	10646	IN	A	204.46.43.217
pipcvsemnaher.com.	10646	IN	A	204.46.43.218
pipcvsemnaher.com.	10646	IN	A	204.46.43.219
pipcvsemnaher.com.	10646	IN	A	204.46.43.220
pipcvsemnaher.com.	10646	IN	A	204.46.43.221
pipcvsemnaher.com.	10646	IN	A	204.46.43.222
pipcvsemnaher.com.	10646	IN	A	204.46.43.223
pipcvsemnaher.com.	10646	IN	A	204.46.43.224
pipcvsemnaher.com.	10646	IN	A	204.46.43.225
pipcvsemnaher.com.	10646	IN	A	204.46.43.226
pipcvsemnaher.com.	10646	IN	A	204.46.43.227
pipcvsemnaher.com.	10646	IN	A	204.46.43.228
pipcvsemnaher.com.	10646	IN	A	204.46.43.229
pipcvsemnaher.com.	10646	IN	A	204.46.43.230
pipcvsemnaher.com.	10646	IN	A	204.46.43.231
pipcvsemnaher.com.	10646	IN	A	204.46.43.232
pipcvsemnaher.com.	10646	IN	A	204.46.43.233
pipcvsemnaher.com.	10646	IN	A	204.46.43.234
pipcvsemnaher.com.	10646	IN	A	204.46.43.235
pipcvsemnaher.com.	10646	IN	A	204.46.43.236
pipcvsemnaher.com.	10646	IN	A	204.46.43.237
pipcvsemnaher.com.	10646	IN	A	204.46.43.238
pipcvsemnaher.com.	10646	IN	A	204.46.43.239
pipcvsemnaher.com.	10646	IN	A	204.46.43.240
pipcvsemnaher.com.	10646	IN	A	217.70.184.38
pipcvsemnaher.com.	10646	IN	A	204.46.43.1
pipcvsemnaher.com.	10646	IN	A	204.46.43.2
pipcvsemnaher.com.	10646	IN	A	204.46.43.3
pipcvsemnaher.com.	10646	IN	A	204.46.43.4
pipcvsemnaher.com.	10646	IN	A	204.46.43.5
pipcvsemnaher.com.	10646	IN	A	204.46.43.6
pipcvsemnaher.com.	10646	IN	A	204.46.43.7
pipcvsemnaher.com.	10646	IN	A	204.46.43.8
pipcvsemnaher.com.	10646	IN	A	204.46.43.9
pipcvsemnaher.com.	10646	IN	A	204.46.43.10
pipcvsemnaher.com.	10646	IN	A	204.46.43.11
pipcvsemnaher.com.	10646	IN	A	204.46.43.12
pipcvsemnaher.com.	10646	IN	A	204.46.43.13
pipcvsemnaher.com.	10646	IN	A	204.46.43.14
pipcvsemnaher.com.	10646	IN	A	204.46.43.15
pipcvsemnaher.com.	10646	IN	A	204.46.43.16
pipcvsemnaher.com.	10646	IN	A	204.46.43.17
pipcvsemnaher.com.	10646	IN	A	204.46.43.18
pipcvsemnaher.com.	10646	IN	A	204.46.43.19
pipcvsemnaher.com.	10646	IN	A	204.46.43.20
pipcvsemnaher.com.	10646	IN	A	204.46.43.21
pipcvsemnaher.com.	10646	IN	A	204.46.43.22
pipcvsemnaher.com.	10646	IN	A	204.46.43.23
pipcvsemnaher.com.	10646	IN	A	204.46.43.24
pipcvsemnaher.com.	10646	IN	A	204.46.43.25
pipcvsemnaher.com.	10646	IN	A	204.46.43.26
pipcvsemnaher.com.	10646	IN	A	204.46.43.27
pipcvsemnaher.com.	10646	IN	A	204.46.43.28
pipcvsemnaher.com.	10646	IN	A	204.46.43.29
pipcvsemnaher.com.	10646	IN	A	204.46.43.30
pipcvsemnaher.com.	10646	IN	A	204.46.43.31
pipcvsemnaher.com.	10646	IN	A	204.46.43.32
pipcvsemnaher.com.	10646	IN	A	204.46.43.33
pipcvsemnaher.com.	10646	IN	A	204.46.43.34
pipcvsemnaher.com.	10646	IN	A	204.46.43.35
pipcvsemnaher.com.	10646	IN	A	204.46.43.36
pipcvsemnaher.com.	10646	IN	A	204.46.43.39
pipcvsemnaher.com.	10646	IN	A	204.46.43.40
pipcvsemnaher.com.	10646	IN	A	204.46.43.41
pipcvsemnaher.com.	10646	IN	A	204.46.43.42
pipcvsemnaher.com.	10646	IN	A	204.46.43.43
pipcvsemnaher.com.	10646	IN	A	204.46.43.44
pipcvsemnaher.com.	10646	IN	A	204.46.43.45
pipcvsemnaher.com.	10646	IN	A	204.46.43.46
pipcvsemnaher.com.	10646	IN	A	204.46.43.47
pipcvsemnaher.com.	10646	IN	A	204.46.43.48
pipcvsemnaher.com.	10646	IN	A	204.46.43.49
pipcvsemnaher.com.	10646	IN	A	204.46.43.50
pipcvsemnaher.com.	10646	IN	A	204.46.43.51
pipcvsemnaher.com.	10646	IN	A	204.46.43.52
pipcvsemnaher.com.	10646	IN	A	204.46.43.53
pipcvsemnaher.com.	10646	IN	A	204.46.43.54
pipcvsemnaher.com.	10646	IN	A	204.46.43.55
pipcvsemnaher.com.	10646	IN	A	204.46.43.56
pipcvsemnaher.com.	10646	IN	A	204.46.43.57
pipcvsemnaher.com.	10646	IN	A	204.46.43.58
pipcvsemnaher.com.	10646	IN	A	204.46.43.59
pipcvsemnaher.com.	10646	IN	A	204.46.43.60
pipcvsemnaher.com.	10646	IN	A	204.46.43.61
pipcvsemnaher.com.	10646	IN	A	204.46.43.62
pipcvsemnaher.com.	10646	IN	A	204.46.43.63
pipcvsemnaher.com.	10646	IN	MX	10 spool.mail.gandi.net.
pipcvsemnaher.com.	10646	IN	MX	50 fb.mail.gandi.net.
pipcvsemnaher.com.	10646	IN	SOA	a.dns.gandi.net. hostmaster.gandi.net. 1380795988 10800 3600 604800 10800

;; Query time: 6 msec
;; SERVER: ::1#53(::1)
;; WHEN: Sat Oct 19 22:07:47 JST 2013
;; MSG SIZE  rcvd: 4013

Observation of DNS Amplification Attack (bls.gov)

bls.gov's ANY becomes huge size because of DNSSEC. It is abused as DDoS.


$ dig @::1 bls.gov any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 bls.gov any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19603
;; flags: qr rd ra; QUERY: 1, ANSWER: 18, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;bls.gov.			IN	ANY

;; ANSWER SECTION:
bls.gov.		86142	IN	SOA	dcgate.bls.gov. blsdnsadmins.bls.gov. 2010042644 1800 300 604800 86400
bls.gov.		86142	IN	RRSIG	SOA 7 2 86400 20131026030030 20131019020030 4712 bls.gov. YeBVU1Ek4HocfJsCDiy5qFe9hCEtnaLGQ/jaX7NgXLsvJ6An1cw5yKLA Tb6fj+ZiOr9dWggrVSeZlzVLHonSv4EUjpLen2fXH1fyaOd9M4SpNk7W /5s+kORqNTLGmn9ubT+EIph8BzTlJ9+FWTjnAZjSJd9CniPVXMuShjL0 5A4s7fQVcvU7mNC0XKFiGrQFW9iiEH/zHAGHbG6nHDBaWzoDBey3Qgwq ojem7dspFWwedki0gXY4neOLMgXM5Ci/8LpXwy3zPIAXyqxTIzTq42yn E2gHBVONRx3auQbI9REYD1f1JZVo1WFzMdalOD0JMHhl9BOICrbmaqFQ 3QHaYQ==
bls.gov.		86142	IN	MX	50 blsmail1.bls.gov.
bls.gov.		86142	IN	MX	10 blsmail.bls.gov.
bls.gov.		86142	IN	RRSIG	MX 7 2 86400 20131026030030 20131019020030 4712 bls.gov. F63OMdDdiUBDY6E3a5g/X1VTm6tBLdQ7OJOshZMpn+ei5GBztYNJZuxT 83QSFMUpgKtq56u9WltrZJJTUfTojFfMosARO/cPaNVQEQPwt4xesXJy e0Rx4m9rhFD1z34AqAoeLod6HanRjhkuizkk6M/MNPmejYJTN4IvyVFC 80TnG6IP6+l/O8jUwvUDGqZh/7mK7+V1+/hY8rZclOTXZB+x+St5N661 YLug66TbssrGgwHUwheFn0s+YVQczdF4eAt1Zk1aCVzuQBq6B2MSe1Al MYs38qXS4h0VO3pxs91M8PTsYCac0JBrvjVG2wPySJOeW9kaNVyCWToQ E9ZPuA==
bls.gov.		86142	IN	A	146.142.4.22
bls.gov.		86142	IN	RRSIG	A 7 2 86400 20131026030030 20131019020030 4712 bls.gov. lTrxdXwGbM6at8ZONnHvKBPM5ieNbk6nRzCnvkRUL0E8Pig/y4B2LV6S QBhdwX5dEvn36YcACnWRSrcCBg/eu9Sr1up8M+2AL21m5p0TB8sc26qw xXZw9ugFcum5XbqgdXnCUuX72mmPorD02JpfnjOJMXbx3hb51mjCK/gc PxWZxFfjmPzZ5IXnGcuve3fiAZI4IK0gvuV9tq2vfSF2V/eRFbuqzY+7 tr2KUVczCANIVfcR6P/t/8C7RN2LgnYGMly6MLxjF3EbBl1OKEMxPmyI uumtFakMyoAO1krWykyVtQGYN6Oe+0fFGv3qTmzbWConfYxiUy/Zg/fj hCB3qQ==
bls.gov.		86142	IN	NS	auth111.ns.uu.net.
bls.gov.		86142	IN	NS	auth120.ns.uu.net.
bls.gov.		86142	IN	RRSIG	NS 7 2 86400 20131026030030 20131019020030 4712 bls.gov. JAtfq6M0Gk0pmzbivyqCZ3e5eOqJrBvMi6cxu/+3b8UEpR4OHy7zLG80 XyrudTz1fZnpLOt0mPVaXLg9PnwDYP47RtNFPzQBP2aYKqQFIwhiSfbG qRtczWGLJOMXRhbLpHOUEiDx3ST/dZH/SNxVFB9h0VkZSpsvxRIo4HYD H55V0O2HthpM4RrFRzyVxwKQN37e4nRC6i03D0krEEekPwFysfe4oWEl g2yHAPicSDDzvtxDDYhcSk3MPPW3FWhVB6xCbRNkpMu9cpnLAwpbzr76 GVSf5gaY+AXK1SS1G6mAxOOqSvlNLSfhmR0Upj8/YAXSD42e5WmVitZK IoYmeg==
bls.gov.		86142	IN	NSEC3PARAM 1 0 12 AABBCCDD
bls.gov.		86142	IN	RRSIG	NSEC3PARAM 7 2 86400 20131026030030 20131019020030 4712 bls.gov. WUyPQJrp4pxtNpIikv41yy3NxFg34+z6OEokuHenn7Vq8iqKPasSEf0F gCfSSdnV3ccKvXyfkedbl6wbME+JDLZytFYuoHf1aHDTm7tB2Enl6sc4 +EmC6z3sWkCxQl6fPCxcb4Qu4pEJ4UuIexcJqir24FyWkYEQkfEbESMG loiLvbW4YA89YUOMxXq9HBGGRWL3O0SJ3zqDzB03vFGzwSCoQ1sPSU4k RQiX4S8XstZVcj/4ZkUf+2Ys00FyzbfL31dZ3uEaFjojbP65ZU/2hFBT znLXcwXH3HPkw515jZ2+4ggsEWvev527rbeXHCETsnrvCOpMOuoYvcV1 T6TcRw==
bls.gov.		86142	IN	DNSKEY	257 3 7 AwEAAW7hTguez7A5q9hJHYUC2bm7HMlm4DKUxDYmEtx0ZAgdfkBDxEUQ tQEnjq5ffDGbNhT589xTEC7Z7LGpv4My8RL/+YHTwT7zLee+C1GJlfXw iItgB+lL3VKgD7YpSk7N355volXPv2nxB+LvxdEYHvuIpqUVhPKd6g7f juX/0R9aHMElX0zdiQdIIi+z9WoX9OTpbmAVD80PwZj5CqTviSBxv5Lr zZgC9PtJmJGDNRUL+i7ydL9czf2xjBVP1NvENvvrTCY5qUqZPTVde3KQ TQ75E4dcxu+KMpeEt/2jdAmrv2d+vcBvKN/2oKUtKRpQkAYqWbuHLoR1 +rLVWsKBhkE=
bls.gov.		86142	IN	DNSKEY	256 3 7 AwEAAWywfaLAmSpwAZal8y596M4jap8ioz+VQoaCYkR4yRknpKN7bSKx ZFTGCjPSaZbsM6RlMgSDOeRZdHdqrWyM2Qq6DVaiIlTK09YsyCK7WNd6 io4uNVGbjEo4Q6OM7iZmoDb/Em3Ymzz/CCRmik/qj9ayoko+FT2m0uYO k0LNzy4wYx2oiSx8HlkZGMItbfYQisNeW9XQG4wvQ7sTIEaySpZmCeFs 6quXEZsxE/jelTvT/xseSNSGRWfE1xFd+ln+LnNFyrFfEApMwjMkw9qf R3vMJMISgi75QnL2U/bCvHqAdxLP6JjN11FzH8wYWJ2eIkmcLAJ4y296 uA+8kacdZzc=
bls.gov.		86142	IN	DNSKEY	257 3 7 AwEAAYXURbzbBOatX1IZP/EsK8UpQRoFPZAuiqSSIE7JukxTpwukpPXB jCfLIsA059mSGkKFEaemeON8T9grMFjNjMl5EoDDuphmjI/6M9y1nPfI YcRould729Rsiw0HvOtN5YtMfbQ6beBhxxnF9mgvZ+TDhf3sRy4SFHws 7E1OT0NvGO1zbph7FnYgi09GZ/XK4CZHyXiQ3R8vv1r5PzIRQrK4xyS8 Kp128ozD0Wj7R1VolN3ZJ+tJWUYnXJe2S0CXRdZYQrPHK/AD3T6xjXee TlOSvLrpWdQtmlrnPsAQ/vuDKqAW0SqvBTjR2JNcaghwXorMgLt78fhm wBnerfn2QTk=
bls.gov.		86142	IN	DNSKEY	256 3 7 AwEAAafkOJX8jrccDObq1UmhKjSiaija4Be5fsbcQ+4RhBVZmaoO+jii EAmPJO/r26b4sYGRQ1f9t6W9UkMt53O6rkxQdWjag5EEpXs2XUmGic2z OYSS8IaIftikJFlulcgBsNyMFxunWG6epdjyfP6DOCrgI6X4ibtnJSbJ vfHVN1VlV/LkBSmxXQhcOnG/6Whv8iSkbNku77sSosjnQACULoPT96Sj dF/Pe1ar9cULJcx+QIvE8sazb6anEPZUqWwYbul3Co0rNV6WPMM1Q7Bn kJgS0490tJ+2xfmoyViELCGUJdhy+HAu7L6dvbUnlb9ZAcp79tAGfB8n y455crDim/M=
bls.gov.		86142	IN	RRSIG	DNSKEY 7 2 86400 20131026030030 20131019020030 4712 bls.gov. Sos3YBlFv6m058FZYcCy8QF5GAZ9m+WwiKkxPv43jFYvbQfsoTJbakkK yaHu9ontB/QyjSG1B0PNA97RX5H8hvWFxw0fs6p0xd/Nj6Xngmk9IKRI cKOzZKwR40gwGdo5nGG/60Y0ZET/S7SjJ4XNtTziqi7nNs90UQ5TpEIm CrGPw+QcNJqBhKuMf33b+lbC3XBlpyjRL8H+1+1kDEL9lRZZKdYjqb5U xn0YZI0mbhMw3KaPESS0bDkK2dlT0VyXHYG3HlsdrEMsAW4Q6AJb0Xmg RWxXllP8HiVUDWrUdt/5GAK2WCRiYEo7JlFmmC2dgDuKaPFWVzOGlpsk s27+zA==
bls.gov.		86142	IN	RRSIG	DNSKEY 7 2 86400 20131026030030 20131019020030 16984 bls.gov. MsZL7LnRanWiQLaGeXlwKu6wLumnZulErb4CisJQk6aretIpNiKzmLT4 JfuKfyYlnYp6cYai9KjPeKbAq31ARubNnEQiLzCgMUGqjpXOLUfJE3LB ZDIccgC+P+XwEjgiELLF0SCQ4HMy+O1OAKOpFtMKEeQkxBqygVu7+0ll LHvzfo5s2MWAeEbZ+BTsaWc/HD5PqGSeihyEHPr4Tm3CJZvrRXSJji9e OH6+TQWr7nBWpvZ9EQoNp0ErYt628Bc379YWlUdzyr3J8WGzHA9A6mhM 3K4Rg2sfiAnpzGB2gvA/6pDChSy5gOunn4gzoQPNHVTfPS2/i/zNAxg8 9GRnSw==

;; Query time: 1 msec
;; SERVER: ::1#53(::1)
;; WHEN: Sat Oct 19 22:02:51 JST 2013
;; MSG SIZE  rcvd: 3389