Unexpected behaviour from the B root servers? Am I setup wrong?

4 msg	Problem with Authoritative PTR Records
4 msg	ACLs as external files
2 msg	generate the same answer to any query
2 msg	nsupdate strangeness v 9.2.3 vs. 9.3.x / 9.4.x
3 msg	Strange DNS Queries
2 msg	bind9.4
3 msg	problems reaching google
2 msg	Statistics query
2 msg	Bind Configuration in fedora core 6
16 msg	Are underscores no longer supported in Bind 9.4?
11 msg	BIND sending quesries to 127.0.0.2?
2 msg	bind 9.2 9.3 different behavior reverse DNS sub...
4 msg	rndc reload doesn't update zone
2 msg	Force reload when include changes
3 msg	Question about nameserver selection mechanism
3 msg	high availability configuration error?
1 msg	cache cleaner could not create iterator: out of...
8 msg	recursive queries fail with high load?

Unexpected behaviour from the B root servers? A...
\ Stephen John Smoogen (25 Feb 2007)
. \ Mark Andrews (26 Feb 2007)
. . \ Stephen John Smoogen (26 Feb 2007)
. \ Peter Dambier (26 Feb 2007)

8 msg	Denial of Service

Subject:	Unexpected behaviour from the B root servers? Am I setup wrong?
Group:	Bind-users
From:	Stephen John Smoogen
Date:	25 Feb 2007

I am only seeing this with the B systems at the moment.. and I am
trying to figure out how I should 'fix' my firewall or backbone DNS
server to deal with it.

Our campus DNS servers will 'proxy' a request to the backbone DNS
servers and when it talks to the B servers, we get requests back from
different IP address from what we sent to (thus our firewall drops it
as a bad session).

129.24.8.1.32768 > 192.228.79.201.domain
192.228.79.200.domain > 129.24.8.1.32768
192.228.79.202.domain > 129.24.8.1.32768
192.228.79.201.domain > 129.24.8.1.32768

This really picked up on Saturday when pretty much every send to the
192.228.79.201 server got 1 to 2 other returns from b1.ip4.int,
b2.ip4.int etc.

The only other servers that the firewall seems to be dropping are some
'questionable' ones in Romania that showed up over the weekend.

--
Stephen J Smoogen. -- CSIRT/Linux System Administrator
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"