Security Incidents mailing list archives

Re: DNS question ?


From: Abe Getchell <agetchel () KDE STATE KY US>
Date: Fri, 9 Feb 2001 14:38:01 -0500

Hi Lars,
        Tell your dial-up users to uncheck 'Register this connection's
address in DNS' on their Win2k machines.  It's in the TCP/IP properties,
after pressing advanced, under the DNS tab.

Thanks,
Abe

Abe L. Getchell - Security Engineer
Division of System Support Services
Kentucky Department of Education
Voice   502-564-2020x225
E-mail  agetchel () kde state ky us
Web     http://www.kde.state.ky.us/



-----Original Message-----
From: Evensen Lars Christian
[mailto:Lars.Christian.Evensen () NETCOM-GSM NO]
Sent: Thursday, February 08, 2001 5:04 AM
To: INCIDENTS () SECURITYFOCUS COM
Subject: DNS question ?


Hi

After scanning thru our DNS security log, i notice a lot of
entries on the
form

notice; denied update from [xxx.yyy.zzz.www] for
"zzz.yyy.xxx.in-addr.arpa".

All these IP-addresses belong to our dialin nodes.

I have been told that this is probably windows 2000/NT trying
to announce it
self to the nameserver. Do anyone know if this is the case,
or is this a
more serious issue i have on my hands.

Regards
Lars Evensen



Current thread: