named.exe high bandwidth usage

ikristher · Joined: 21 Aug 2014 Posts: 4

Hello,
Recently we encounter high network usage from our firstspot server and upon checking using tcpview, we saw that named.exe is causing the high traffic. I think it is being used by outsiders as their dns server or the file has been compromised.

How do we resolve this?

Thanks

alan · **Forum facilitator** Joined: 26 Sep 2003 Posts: 4435

What is the FirstSpot version you are currently using?
_________________
~ Patronsoft Limited ~

ikristher · Joined: 21 Aug 2014 Posts: 4

Here is the version

FirstSpot® v7.1.0
Premium Edition

SBB · Joined: 01 Nov 2012 Posts: 10

Hi

We have noticed the same on one of our servers over the weekend (v7.0.11)

Lubin Poulton

ikristher · Joined: 21 Aug 2014 Posts: 4

Any ideas on how to solve this? It seems there is a DNS attack on our server.

alan · **Forum facilitator** Joined: 26 Sep 2003 Posts: 4435

Can you simply blacklist that particular client device from your visitor network?
_________________
~ Patronsoft Limited ~

SBB · Joined: 01 Nov 2012 Posts: 10

Hi

Our traffic was coming via the internet facing card, we have blocked the traffic at our gateway.

alan · **Forum facilitator** Joined: 26 Sep 2003 Posts: 4435

That is probably the best way. Normally, you want to put a NAT firewall between FirstSpot and your Internet connection.
_________________
~ Patronsoft Limited ~

ikristher · Joined: 21 Aug 2014 Posts: 4

Yes we already blocked it. I guess this is the only solution.
Thanks