Re: Interesting DNS Traffic

["Ryan Russell" <Ryan.Russell () sybase com>]

> However, I see DNS  requests and WWW requests come in where the souce
> port on the packet originates in the 800 range rather than the
> standard 1024-65535 range. Therefore the reply back is denied.
>
> Example.
>
> xxx.xxx.xxx.xxx (879) -->   204.253.83.10 (53)
>
> meaning a packet came in from the internet going to my DNS, however
> the source port of the packet was 879.

This means someone has an internal DNS server behind a Firewall-1
that is doing hide NAT, and you've borken his ability to do DNS lookups
to your site.

My opinion is that trying to derive any kind of security posture from
source ports of machines you don't control is pointless.

On the other hand, you aren't the only one to break FW-1 sites
this way, so they'll eventually learn and change their DNS
server to a static translation, and you'll see the traffic
with a source port of 53.

                    Ryan