Re: Unusual DNS requests (not related to previous DNS thread)

From: Greg A. Woods (woodsat_private)
Date: Tue Jan 15 2002 - 08:57:24 PST

Next message: Andrew Simmons: "Re: Connection Attempts"

Previous message: Ryan Russell: "Re: Unusual DNS requests (not related to previous DNS thread)"
In reply to: measlat_private: "Unusual DNS requests (not related to previous DNS thread)"
Next in thread: Cloppert, Michael: "RE: New DNS connection with SYN ACK"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

[ On Monday, January 14, 2002 at 17:37:17 (-0600), measlat_private wrote: ]
> Subject: Unusual DNS requests (not related to previous DNS thread)
>
> So far, so good.  The request is for a PTR
> record: 0.xxx.xxx.xx.in-addr.arpa.  No, that's not a typo, they are
> requesting reverse for the network address at .0.  A packet capture shows
> absolutely nothing out of the ordinary, other than the freaky request, and
> the regularity of the requests, about one request every five seconds, round
> the clock.

It's not unusual at all.  Please read RFC 1101.

-- 
								Greg A. Woods

+1 416 218-0098;  <gwoodsat_private>;  <g.a.woodsat_private>;  <woodsat_private>
Planix, Inc. <woodsat_private>; VE3TCP; Secrets of the Weird <woodsat_private>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Andrew Simmons: "Re: Connection Attempts"
Previous message: Ryan Russell: "Re: Unusual DNS requests (not related to previous DNS thread)"
In reply to: measlat_private: "Unusual DNS requests (not related to previous DNS thread)"
Next in thread: Cloppert, Michael: "RE: New DNS connection with SYN ACK"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Jan 15 2002 - 13:19:50 PST