DNS port flooding

Sounds like a question of the CCIE R&S lab; for starters if you have a switched enviroment you could do something like: interface FastEthernet0/1 switchport access vlan 160 storm-control broadcast level 25.00 storm-control action shutdown spanning-tree portfast

To deny a specific host from DHCP:

access-list 101 deny udp host 1.1.1.1 eq domain host 2.2.2.2 log access-list 101 permit ip any any

where 1.1.1.1 is the host and 2.2.2.2 is the DHCP server; this ACL would be placed on the ingress of your Ethernet interface.

interface F0/0 ip access-group 101 in

As a general rule you should create the acl based on what you want to 'allow' and let everything else get trapped by the explicit deny at the end .. there are exceptions to this of course.

In your case this single line takes care of the first two requirements:

permit udp any host eq 53

I thought CBAC could control the rate of new connections but I only see 'half-open' limits:

BernieM

Also came across this on the catIOS switchs

Switch(config)#errdisable detect cause dhcp-rate-limit

Also came across this on the catIOS switchs

Switch(config)#errdisable detect cause dhcp-rate-limit

I just noticed my suggestion doesn't address rule #2 "deny 'some' hosts from accessing the dns". With that one there's not much else to do except block addresses individually. Have you tried to contact the sys admins responsible for each address? Sometimes it's a misconfiguration on their part and they appreciate having someone tell them about it ... sometimes not.

BernieM

I don't know about #3 (some other responses mentioned a DHCP rate limit, but not DNS), but #1 and #2 can be done easily with extended ACLs:

access-list 101 deny udp host x.x.x.x any eq domain access-list 101 deny tcp host x.x.x.x any eq domain access-list 101 deny udp host y.y.y.y any eq domain access-list 101 deny tcp host y.y.y.y any eq domain ... access-list 101 permit udp any host eq domain access-list 101 permit tcp any host eq domain