actually, it is common some DNS servers source from 53. since it is DNS
traffic, why not look into the payload and see what is being requested
? even something like 'tcpdump -X port 53' should give you some readable
ouput.
did you say it was tcp or udp ?
--truman
On Wed, 4 Jul 2001, Nazila Mofrad wrote:
> Hi everybody,
>
> I found logs of some incoming TCP packets with both source and
> destination ports as 53, on firewall. Actually, the packets are
> destined to our DNS server, but the fact that the source port is 53 as
> well, sounds strange; doesn't it? Is it any incident?
>
> thanks in advance, Nazila M.
>
>
> _______________________________________________
> Firewalls mailing list
> [EMAIL PROTECTED]
> http://lists.gnac.net/mailman/listinfo/firewalls
>
_______________________________________________
Firewalls mailing list
[EMAIL PROTECTED]
http://lists.gnac.net/mailman/listinfo/firewalls
