How to prevent DNS flooding

[IPS_User]

I found that many DNS queries coming from Internet is sent to my DNS server every minutes. Although they query the valid domain name, the hostname is a fake & random generated value or the query type is ANY.

However, those traffic did not trigger any attack filter, and I am use 600 N series IPS, would you please tell me how I can prevent this attack?

[cenk sasmaztin]

please try

filter 1350,1351,1352,1353,1354,1355

[IPS_User]

Thank you for your information, Cenk Sasmaztin!

All your mentioned filters are enabled, but no triggered.

[cenk sasmaztin]

may be use snort rules for dns attack

download snort rules from snort web site and convert tipping point filter with dv converter tool

please watch my video

http://youtu.be/JatIvCv4zow