Craig: "what is the nameserver service"?? Ouch...
Pat: I don't beleive it... that sounds like a crock.. "we transfer the
whole zone using tcp instead of one query using udp to save bandwidth..."
Did you tell them to pull the other one?
I see alot of this myself, and usually it's someone using "host" or "dig"
or something to initiate a zone transfer so they can see what you have in
DNS. Look at your logs after doing "host -l -v -t any yourdomain.com" and
see if that doesn't look a little familiar... (btw.. run that command line
on a linux box.. not a windoze box).
Carric Dooley CNE
COM2:Interactive Media
http://www.com2usa.com
"Luck is the residue of design."
- Branch Rickey - former owner of the Brooklyn Dodger Baseball Team
On Wed, 21 Jun 2000, Scopelliti, Pasquale F wrote:
> I've seen some DNS Zone Transfer attempts from sites that were not secondary DNS for
>us. Reached at least one of them and they said they had some old application that
>tried to optimize performance by grabbing DNS data rather than using the network.
>
> Pat
>
> Pasquale Scopelliti
> Corning Internet Team
>
>
> > ----------
> > From: Little, Craig[SMTP:[EMAIL PROTECTED]]
> > Sent: Wednesday, June 21, 2000 2:33 PM
> > To: [EMAIL PROTECTED]
> > Subject: nameserver
> >
> > There seem to be a few servers out there that are trying to communicate with
> > my firewall using the nameserver service. The server in question isn't a
> > secondary for any of our name spaces, and I can't figure out why it would be
> > trying to do this.
> >
> > What is the nameserver service. I assume it is something to do with DNS.
> >
> >
> > Kind regards,
> >
> > Craig Little BSc, CPD, CPI, SCJP, CCSA, CCSE
> > Inter-networking / Security Consultant
> >
> > Shell Services International
> >
> > Phone: +64 4 462 4661
> > Fax: +64 4 463 4060
> > Mobile: +64 21 37 5858
> > mailto:[EMAIL PROTECTED]
> > http://www.shellservices.com
> > -
> > [To unsubscribe, send mail to [EMAIL PROTECTED] with
> > "unsubscribe firewalls" in the body of the message.]
> >
> -
> [To unsubscribe, send mail to [EMAIL PROTECTED] with
> "unsubscribe firewalls" in the body of the message.]
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
