If it's coming from Exodus, they may be using F5's 3dns server which does
a null socket connect to your local dns servers using tcp to get rtt and
latency. They (f5 3dns) uses this information to get the best response
time and will load balance their servers behind accordingly. In your logs
you will see port connects to tcp 53.
Rich
On Mon, 25 Oct 1999, Joe Matusiewicz wrote:
> At 11:07 AM 10/25/99 -0500, Eric wrote:
> >Joe Matusiewicz wrote:
> > >
> > > Are the source ip addresses from exodus.net?
> >
> >Yes. Always without a reverse lookup, too.
> >
> >Eric Johnson
>
>
> I've first noticed them about three weeks ago. They look sort of like
> traceroutes, but instead of the timestamp of each of the packets getting
> incremented by a couple of seconds, they all have the same timestamp. They
> originate from at least 5 servers in the exodus.net address space and they
> target dns servers. I wrote to exodus and they told me that it was due to
> Real servers that are negotiating ports for a better connection with my
> users who are running RealAudio at their desktop. I would have believed
> this if they were going to regular hosts, but these go to our dns
> servers. Our dns servers are *nix and only run BIND.
>
> But somehow RealAudio is involved. I looked at the ip addresses that do
> these "traceroutes" and see that they are on the same networks that some of
> my users' Real servers. I think it is some new program that "measures
> latency" by banging on your dns such as the Global Dispatch software
> discussed here a while back.
>
> -- Joe
>
>
> -
> [To unsubscribe, send mail to [EMAIL PROTECTED] with
> "unsubscribe firewalls" in the body of the message.]
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
