Unusual IN ANY DNS Traffic

Douglas E. Warner dwarner at ctinetworks.com
Tue May 10 16:23:34 UTC 2005


On Tuesday 10 May 2005 12:14, Duane Wessels wrote:
> One thing I've noticed that likes to generate ANY queries is Qmail...

I guess I should've stated that these are almost all some DSL customers on our 
network using their assigned DNS servers, but this traffic is just completely 
out of normal; especially since they were all looking for "msn.com.".
Another thing that is quite odd (to me) is that the source port is all port 
53; I thought that normal clients would use a random high port to do queries 
from.

-Doug

-- 
Douglas E. Warner    <dwarner at ctinetworks.com>     Network Engineer
CTI Networks, Inc.   http://www.ctinetworks.com    +1 717 975 9000
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20050510/787a5c19/attachment.sig>


More information about the NANOG mailing list