Re: Malicious DNS request?

2005-05-17 Thread Joe Shen
Hi, thanks for your help. I noticed that the requests of those non-exist domain name disappeared yesterday. But the NXDOMAIN record in named.stats keep increasing. ( see attachment) I'm using BIND9.2.5 BIND9.3.1 on two Solaris box, each box has two CPUs installed. it's found BIND8.4.6 running

Re: Malicious DNS request?

2005-05-17 Thread Joe Shen
Sorry to attach the rndc stats result. I run rndc stats continuously( interval is less than 2 seconds), it's shown: success 17950622 referral 225680 nxrrset 1691861 nxdomain 11203490 recursion 3648017 failure 1363923 ... --- Statistics Dump --- (1116319437) +++ Statistics

Re: Malicious DNS request?

2005-05-17 Thread Joe Shen
Sorry to attach the rndc stats result. I run rndc stats continuously( interval is less than 2 seconds), it's shown: success 17950622 referral 225680 nxrrset 1691861 nxdomain 11203490 recursion 3648017 failure 1363923 ... --- Statistics Dump --- (1116319437) +++ Statistics

Re: Malicious DNS request?

2005-05-17 Thread Paul Vixie
[EMAIL PROTECTED] (Joe Shen) writes: I'm using BIND9.2.5 BIND9.3.1 on two Solaris box, each box has two CPUs installed. it's found BIND8.4.6 running on one CPU could reach the throughput of BIND9.*.* running on two CPUs. Could we improve server throughput or lower lower the effect of

Network Mitigation Devices

2005-05-17 Thread Kevin Billings
Has anyone had any experience using Network Mitigation devices like the Cisco Guard XT 5650? I am looking to install one in our network and would like to know if anyone has used the Cisco device? thanks

Microsoft broke MTU discovery by last security pathces??

2005-05-17 Thread Alexei Roudnev
Do you have amny information about last Microsoft problems with security patches? We can see, how one of last updates broke MTU discovery (not totally, but it restricts number of discovered pathes so servers tsop working in a few days). And, amazingly, no one published this problem.

Re: Microsoft broke MTU discovery by last security pathces??

2005-05-17 Thread Mike Tancsa
There is discussion on ntbugtraq http://www.ntbugtraq.com/default.aspx?pid=36sid=1A2=ind0505L=ntbugtraqT=0O=DF=NP=192 ---Mike At 04:43 PM 17/05/2005, Alexei Roudnev wrote: Do you have amny information about last Microsoft problems with security patches? We can see, how one of last updates

FCC set to require 911 for VoIP as early as Thursday...

2005-05-17 Thread Fergie (Paul Ferguson)
Things just seem to coalesce sometimes. http://www.reuters.com/newsArticle.jhtml?type=topNewsstoryID=8521222 - ferg -- Fergie, a.k.a. Paul Ferguson Engineering Architecture for the Internet [EMAIL PROTECTED] or [EMAIL PROTECTED] ferg's tech blog: http://fergdawg.blogspot.com

Re: Malicious DNS request?

2005-05-17 Thread Joe Shen
Paul, I'm sorry if this is JUST to BIND or some other specific software. But, IMHO this is just a sample that requests which only generate NXDOMAIN responds. According to someone's presentation on NANOG (DNS anomailies and their impact on DNS Cache Server ), such record may be type of attack.

Re: Underscores in host names

2005-05-17 Thread Mark Andrews
In article [EMAIL PROTECTED] you write: Hello all. We have a client containing an underscore in the email address domain name. Our email server rejects it because of it's violation of the RFC standard. This individuals claim is that he doesn't have problems anywhere else and if this is going to

Re: Underscores in host names

2005-05-17 Thread Valdis . Kletnieks
In article [EMAIL PROTECTED] you write: Hello all. We have a client containing an underscore in the email address domain name. Our email server rejects it because of it's violation of the RFC standard. This individuals claim is that he doesn't have problems anywhere else and if this is going to

Re: Malicious DNS request?

2005-05-17 Thread Brad Knowles
At 8:45 AM +0800 2005-05-18, Joe Shen wrote: I'm sorry if this is JUST to BIND or some other specific software. But, IMHO this is just a sample that requests which only generate NXDOMAIN responds. Do a DNS query for

Re: Underscores in host names

2005-05-17 Thread Mark Andrews
One should note that COM and other tld's stopped giving out domains outside of LDH to prevent these sorts of interoperability issues. COM actually retrieved the ones they had delegated.

Re: Underscores in host names

2005-05-17 Thread Jay R. Ashworth
On Wed, May 18, 2005 at 11:08:03AM +1000, Mark Andrews wrote: In article [EMAIL PROTECTED] you write: Hello all. We have a client containing an underscore in the email address domain name. Our email server rejects it because of it's violation of the RFC standard. This individuals claim is

Re: Underscores in host names

2005-05-17 Thread Steven Champeon
on Wed, May 18, 2005 at 11:08:03AM +1000, Mark Andrews wrote: RFC 952 and RFC 1123 describe what is currently legal in hostnames. Underscore is NOT a legal character in a hostname. So, these are *all* non-compliant? Perhaps someone should tell them that. Certainly would