On Tue, 16 Jul 2002, Marco van Berkum wrote: > Jul 16 14:43:23 obiwanken named[30114]: wrong ans. name > (\\0016\\002.3\\00212\\003202\\007in-addr\\004arpa\\000\\000\\012\\000\\001\\192\\011\\000\\012\\000\\001\\000\\000\\168\\192\\000\\018\\006proxy6\\003psu\\002ac\\002th > != 6.73.12.202.in-addr.arpa) > Jul 16 14:43:26 obiwanken named[30114]: wrong ans. name > (\\0016\\002.3\\00212\\003202\\007in-addr\\004arpa\\000\\000\\012\\000\\001\\192\\011\\000\\012\\000\\001\\000\\000\\168\\192\\000\\018\\006proxy6\\003psu\\002ac\\002th > != 6.73.12.202.in-addr.arpa) <message clipped for brevity> This is a response-check message (see http://triton.process.com/bind-docs/logging.html). According to http://www.isc.org/ml-archives/bind-users/2000/04/msg00610.html, "Zoe Wianiak wrote: > Apr 12 07:53:36 Shears named[107]: wrong ans. > name(\003144\00226\00212\007in-addr\004arpa\000\000\012\000\001\192\015\000\012\000\001\000\001Q\128\000\017\011topptelecom\003com > != 238.144.26.12.in-addr.arpa) > > Could this be an attempt at a buffer overflow? Unlikely. It's just named's cryptic way of saying it thinks it got a 144.26.12.in-addr.arpa answer to a 238.144.26.12.in-addr.arpa question. The only reason it looks so big and nasty is because it's showing the raw wire format of the answer it got, with all of the non-printable characters escaped. But it's actually the same size as the correct response would have been. In fact, it *is* the correct response, except that a chunk of it has been shifted 4 bytes backwards (which just so happened to have neatly trimmed the initial "238." from the answer, otherwise named would have probably just considered it a generic "malformed response"), with the resulting gap filled by seemingly-random values. I don't think I've ever seen corruption quite like that before. Given the nature of the corruption, I consider it more likely a problem with the responding server than with some network component. Strangely, I'm not getting malformed responses from either ns1.hydrogenmedia.net or ns2.hydrogenmedia.net, the authoritative servers for 144.26.12.in-addr.arpa. So either you got this bogon from a forwarder or the problem was only transient." (Thanks to Kevin Darcy for his 4/2000 posting to the BIND users mailing list.) I'm adding the BIND logging link to the Log Analysis Web site. Remember, Google is your friend... HTH -- tbird --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Tue Jul 16 2002 - 06:45:59 PDT