FW: weird DNS logs
> -----Original Message-----
> From: K 0 [mailto:koml@strato.net]
> Sent: Thursday, December 14, 2000 2:23 PM
> To: INCIDENTS@SECURITYFOCUS.COM
> Subject: weird DNS logs
>
>
> anyone seen the following before ...? i suspect is some kind of
> DoS but i have never seen it before. if anyone has seen it can
> you tell me what it is and is there anyway i can prevent this.
> Its killing the syslog daemone and the named daemon every few hours.
>
> Dec 14 14:20:14 orange named[23402]: bad referral
> (ULS3\\.FOUR11\\.COM !< net)
> Dec 14 14:20:14 orange last message repeated 11 times
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'A.ROOT-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'E.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'F.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'J.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'K.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'A.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'M.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'G.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'C.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'I.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'B.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange named[23402]: unrelated additional info
> 'D.GTLD-SERVERS.net' type A from [192.203.230.10].53
> Dec 14 14:20:14 orange sshd[23446]: log: Password authentication
> for sysadm accepted.
> Dec 14 14:20:14 orange named[23402]: bad referral
> (ULS3\\.FOUR11\\.COM !< NET)
> Dec 14 14:20:14 orange last message repeated 11 times
Reply to: