Subject: Bind - Log entry suspicious

From: Markus Schreier <[email-masked]>
Date: Thu, 24 May 2001 14:37:38 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello all,
i know named is a bit off topic. But still i hope you can help me with
my question.

We are running named verson 8.2.3

Now i've discoverd the following log-entry:
....... named[8999]: Response from unexpected source
([205.252.14.31].53)

I would guess, that someone tried to pass over data to the nameserver,
which was not requested. I hope my nameserver didn't accept it.

I found out the name of the calling server:
Name:    ns-corp3b.cais.net
Address:  205.252.14.31

Does anybody know, what realy happend ? Do i've to take actions?

Thanks for your help.

Markus Schreier 

Systeme & Netze
ORDIX AG

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 24 May 2001 16:45:09 -0400

On Thu, May 24, 2001 at 02:37:38PM +0200, Markus Schreier wrote:
...
> ....... named[8999]: Response from unexpected source

Gee, I thought this was a bind-users mailing list question until I hit
"r"espond.  ;-)

Look back in your log a bit, back LONGER than the name resolver
time-out.  If you're logging the name server's queries, I suspect that
you'll find that a query went out TO this name server, but timed out.
Then it responded!

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.