Re: Паразитный трафик в сети

[Mikolaj Golub <golub@inec.kharkov.com>]

On Mon, 17 Apr 2006 22:49:39 +0400 Poul wrote:

 P> Доброго времени суток!
 P> Поставил тут на днях bind, настроил, вроде работает, но в сети стало
 P> твориться что-то странное: примерно каждую секунду происходит обращение
 P> по сети. tcpdump на стороне клиента выдает вот это:

 P> 22:18:29.604174 IP hip.lan.32924 > pluto.lan.domain:  56363+ A?
 P> localhost.pluto.lan. (37)
 P> 22:18:29.604881 IP pluto.lan.domain > hip.lan.32924:  56363 NXDomain*
 P> 0/1/0 (76)
 P> 22:18:29.613853 IP hip.lan.32924 > pluto.lan.domain:  56364+ A?
 P> localhost. (27)
 P> 22:18:29.614475 IP pluto.lan.domain > hip.lan.32924:  56364* 1/1/1 A
 P> hip.lan (82)

rfc1536

   Some applications, in fact, prompt NXDOMAIN answers! When given a
   perfectly good name to resolve, they append the local domain to it
   e.g., an application in the domain "foo.bar.com", when trying to
   resolve the name "usc.edu" first tries "usc.edu.foo.bar.com", then
   "usc.edu.bar.com" and finally the good name "usc.edu". This causes at
   least two queries that return NXDOMAIN, for every good query. The
   problem is aggravated since the negative answers from the previous
   queries are not cached.  When the same name is sought again, the
   process repeats.

На hip.lan в /etc/hosts нету записи для localhost?

-- 
to my, trociny