bind-9.3会话数问题

qklqkl

FreeBSD6.1
BIND 9.3.5-P2
架设双线分段转发DNS，本地大概有20-30个域的解析，其余均转发。但是DNS服务器发起太多的会话数，在防火墙中可以看到DNS服务器ip的会话数量。将数量限制先来后也能解析但是据反映打开6个页面以上就再打不开了。防火墙上有丢弃会话的记录。将会话数量直接限制在500左右，切换DNS服务器之后，baidu   sina  等这些网站时能解析时不能解析。。。
按理来说如果又一次成功解析，就应该在缓存中有记录，下次解析就可以直接解析，为什么还出现时能解析时不能解析的情况。将DNS服务器换IP测试没有问题都可以解析，但是只要切成正式的DNS IP问题依旧，而且从bind log 中有大量的日志：
08-Dec-2009 22:11:56.673 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.673 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.682 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.682 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.686 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.696 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.706 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.706 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.706 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.706 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.706 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.719 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.746 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.754 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.754 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.761 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.761 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.768 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.774 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.784 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.787 general: error: socket: too many open file descriptors
08-Dec-2009 22:11:56.787 general: error: socket: too many open file descriptors

请各位分析分析 研究研究为什么DNS会产生如此大的会话量，防火墙上大概有3-5W左右的会话记录。

[ 本帖最后由 qklqkl 于 2009-12-10 16:43 编辑 ]

llzqq

怀疑有外部攻击，查查这么连接都在查询什么记录。

[ 本帖最后由 llzqq 于 2009-12-10 19:36 编辑 ]

qklqkl

将dns服务器在防火墙上的会话数限制调大，DNS的解析就正常了。。。

bpxyz

开启bind查询日志，或者干脆在bind机器上抓包，看看出了什么问题！