# DNS Aplification blitz

**URL:** <https://forum.suricata.io/t/dns-aplification-blitz/1007>\
**Category:** Help\
**Created:** [January 24, 2021, 5:50pm UTC](https://forum.suricata.io/t/dns-aplification-blitz/1007 "2021-01-24T17:50:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jimoe](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@jimoe](https://forum.suricata.io/u/jimoe)\
**Post date:** [January 24, 2021, 5:50pm UTC](https://forum.suricata.io/t/dns-aplification-blitz/1007/1 "2021-01-24T17:50:11Z")

</div>

Over the last 3 days we have had a surge of DNS amplification attacks. We use fail2ban to ban IPs that dare to trespass. Previously there were about 200 IPs banned, and it was a fairly steady count over the ban time.

Then this surge… Every 1 minute there is a new IP trying the attack. The count has risen to 4200 IPs banned and no end in sight.

Is this type of event “normal”?

01/24/2021-10:38:13.037029 [Drop] [**] [1:2016016:8] ET DOS DNS Amplification Attack Inbound [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 107.179.200.154:35523 → 192.168.69.246:53