We see the following hammering on one of our DNS servers (log copy below). 204.188.100.4 is an IP assigned to the NIC on the mail server (although it is not assigned to any mail domain or web site) and 206.168.216.6 is one of the DNS servers. We are seeing this behavior sporadically and it is hammering the DNS server when it happens. Shouldn't declude be querying the relays.osirusoft.com directly? Also why is it doing it so many time for the same host?
Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com 15:33:59.193916 204.188.100.4.1814 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:33:59.194588 204.188.100.4.1815 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:33:59.195248 204.188.100.4.1816 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:33:59.196044 204.188.100.4.1817 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:33:59.196764 204.188.100.4.1818 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:33:59.197370 204.188.100.4.1819 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:33:59.197989 204.188.100.4.1820 > 206.168.216.6.53: 1+ A? 58.64.224.199.relays.osirusoft.com. (52) 15:34:03.349931 204.188.100.4.1830 > 206.168.216.6.53: 1+ A? 151.245.37.216.relays.osirusoft.com. (53) 15:34:03.350973 204.188.100.4.1831 > 206.168.216.6.53: 1+ A? 151.245.37.216.relays.osirusoft.com. (53) 15:34:03.351339 204.188.100.4.1832 > 206.168.216.6.53: 1+ A? 151.245.37.216.relays.osirusoft.com. (53) 15:34:03.352010 204.188.100.4.1833 > 206.168.216.6.53: 1+ A? 151.245.37.216.relays.osirusoft.com. (53) 15:34:03.352850 204.188.100.4.1834 > 206.168.216.6.53: 1+ A? 151.245.37.216.relays.osirusoft.com. (53) 15:34:03.353466 204.188.100.4.1835 > 206.168.216.6.53: 1+ A? 151.245.37.216.relays.osirusoft.com. (53) 15:34:17.349754 204.188.100.4.1852 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:17.350543 204.188.100.4.1853 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:17.351213 204.188.100.4.1854 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:17.352364 204.188.100.4.1855 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:17.353024 204.188.100.4.1856 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:17.353328 204.188.100.4.1857 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:17.353993 204.188.100.4.1858 > 206.168.216.6.53: 1+ A? 110.49.153.217.relays.osirusoft.com. (53) 15:34:20.708969 204.188.100.4.1872 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:20.709577 204.188.100.4.1873 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:20.710307 204.188.100.4.1874 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:20.710977 204.188.100.4.1875 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:20.711728 204.188.100.4.1876 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:20.712389 204.188.100.4.1877 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:20.713063 204.188.100.4.1878 > 206.168.216.6.53: 1+ A? 60.91.41.200.relays.osirusoft.com. (51) 15:34:59.848786 204.188.100.4.2097 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:34:59.849468 204.188.100.4.2098 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:34:59.850148 204.188.100.4.2099 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:34:59.850893 204.188.100.4.2100 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:34:59.851556 204.188.100.4.2101 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:34:59.852225 204.188.100.4.2102 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:34:59.853975 204.188.100.4.2103 > 206.168.216.6.53: 1+ A? 65.94.203.208.relays.osirusoft.com. (52) 15:35:00.067865 204.188.100.4.2112 > 206.168.216.6.53: 1+ A? 112.94.203.208.relays.osirusoft.com. (53) 15:35:00.068626 204.188.100.4.2113 > 206.168.216.6.53: 1+ A? 112.94.203.208.relays.osirusoft.com. (53) 15:35:00.069599 204.188.100.4.2114 > 206.168.216.6.53: 1+ A? 112.94.203.208.relays.osirusoft.com. (53) 15:35:00.070437 204.188.100.4.2115 > 206.168.216.6.53: 1+ A? 112.94.203.208.relays.osirusoft.com. (53) 15:35:00.071116 204.188.100.4.2116 > 206.168.216.6.53: 1+ A? 112.94.203.208.relays.osirusoft.com. (53) 15:35:00.071750 204.188.100.4.2117 > 206.168.216.6.53: 1+ A? 112.94.203.208.relays.osirusoft.com. (53) 15:35:06.879659 204.188.100.4.2136 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:06.880328 204.188.100.4.2137 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:06.881001 204.188.100.4.2138 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:06.881865 204.188.100.4.2139 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:06.882456 204.188.100.4.2140 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:06.883143 204.188.100.4.2141 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:06.883763 204.188.100.4.2142 > 206.168.216.6.53: 1+ A? 134.220.170.63.relays.osirusoft.com. (53) 15:35:07.098891 204.188.100.4.2151 > 206.168.216.6.53: 1+ A? 76.100.188.204.relays.osirusoft.com. (53) 15:35:07.099783 204.188.100.4.2152 > 206.168.216.6.53: 1+ A? 76.100.188.204.relays.osirusoft.com. (53) 15:35:07.100387 204.188.100.4.2153 > 206.168.216.6.53: 1+ A? 76.100.188.204.relays.osirusoft.com. (53) 15:35:07.100833 204.188.100.4.2154 > 206.168.216.6.53: 1+ A? 76.100.188.204.relays.osirusoft.com. (53) 15:35:07.101516 204.188.100.4.2155 > 206.168.216.6.53: 1+ A? 76.100.188.204.relays.osirusoft.com. (53) 15:35:07.102205 204.188.100.4.2156 > 206.168.216.6.53: 1+ A? 76.100.188.204.relays.osirusoft.com. (53) 15:35:16.629513 204.188.100.4.2176 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) 15:35:16.630311 204.188.100.4.2177 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) 15:35:16.630973 204.188.100.4.2178 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) 15:35:16.631777 204.188.100.4.2179 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) 15:35:16.632439 204.188.100.4.2180 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) 15:35:16.633097 204.188.100.4.2181 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) 15:35:16.633762 204.188.100.4.2182 > 206.168.216.6.53: 1+ A? 34.136.230.12.relays.osirusoft.com. (52) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
