At 11:07 AM 10/25/99 -0500, Eric wrote:
>Joe Matusiewicz wrote:
> >
> > Are the source ip addresses from exodus.net?
>
>Yes. Always without a reverse lookup, too.
>
>Eric Johnson
I've first noticed them about three weeks ago. They look sort of like
traceroutes, but instead of the timestamp of each of the packets getting
incremented by a couple of seconds, they all have the same timestamp. They
originate from at least 5 servers in the exodus.net address space and they
target dns servers. I wrote to exodus and they told me that it was due to
Real servers that are negotiating ports for a better connection with my
users who are running RealAudio at their desktop. I would have believed
this if they were going to regular hosts, but these go to our dns
servers. Our dns servers are *nix and only run BIND.
But somehow RealAudio is involved. I looked at the ip addresses that do
these "traceroutes" and see that they are on the same networks that some of
my users' Real servers. I think it is some new program that "measures
latency" by banging on your dns such as the Global Dispatch software
discussed here a while back.
-- Joe
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
