Re: Unusually High Client DNS Query Volume -- lots of hits.

Matt Jonkman wrote:
> That's a much better sig than the original. Whoever wrote that original
> one is some kind of moron...  :)
>
> I'll post this asap. Appreciate you expanding on the concept!
>
>   
BLEEDING-EDGE POLICY Possible Spambot -- Host DNS MX Query High Count
<https://ruru.insec/placid/summary.py?%20&timebefore=86400%20%20&signame=BLEEDING-EDGE%20POLICY%20Possible%20Spambot%20--%20Host%20DNS%20MX%20Query%20High%20Count%20&ipdst=distinct%20&groupby=signatures>
is *much* better  I'm getting thousands of hits off the foundry boxes in
front of our MTAs and bugger all else!   I'll tweak the oinkmaster
config to change the source field and all should be hunky dory!

Thanks Chris!

Russell