Re: Malformed DNS or something odd (or just me)

["Paul Daniel" <paul () pdaniel co uk>]

-----Original Message-----
From: Butterworth, Jim [mailto:jim.butterworth () guidancesoftware com]
Sent: 10 November 2004 21:45
To: Paul Daniel
Subject: RE: Malformed DNS or something odd (or just me)


You got the whole TCPDUMP output?

r/Jim

These are 3 separate packets (slightly obscured) using Windump:

10:54:34.211423 mac1 > mac2, ethertype IPv4 (0x0800), length 60: IP (tos
0x0, ttl 112, id 4591, offset 0, flags [none], length: 46) 203.206.52.94.53
> myipadd.53: [udp sum ok]  258 [b2&3=0x7] [16323a] [53638q] [9748n]
[257au][|domain]
        0x0000:  0080 c8f2 fc7a 00d0 2b75 018c 0800 4500  .....z..+u....E.
        0x0010:  002e 11ef 0000 7011 3663 cbce 345e 5225  ......p.6c..4^R%
        0x0020:  b01b 0035 0035 001a 9e7a 0102 0007 d186  ...5.5...z......
        0x0030:  3fc3 2614 0101 449d ab62 3500            ?.&...D..b5.
11:03:31.411671 mac1 > mac2, ethertype IPv4 (0x0800), length 60: IP (tos
0x0, ttl 117, id 6509, offset 0, flags [none], length: 46) 4.138.224.106.53
> myipadd.53: [udp sum ok]  258 [b2&3=0x7] [16323a] [53638q] [9748n]
[257au][|domain]
        0x0000:  0080 c8f2 fc7a 00d0 2b75 018c 0800 4500  .....z..+u....E.
        0x0010:  002e 196d 0000 7511 451d 048a e06a 5225  ...m..u.E....jR%
        0x0020:  b01b 0035 0035 001a c85e 0102 0007 d186  ...5.5...^......
        0x0030:  3fc3 2614 0101 40c9 a08a 3500            ?.&...@...5.
11:13:29.914292 mac1 > mac2, ethertype IPv4 (0x0800), length 510: IP (tos
0x0, ttl 111, id 273, offset 0, flags [none], length: 496) 202.231.176.70.38
> myipadd.53:  258 [b2&3=0x7] [16323a] [53638q] [9748n] [332au][|domain]
        0x0000:  0080 c8f2 fc7a 00d0 2b75 018c 0800 4500  .....z..+u....E.
        0x0010:  01f0 0111 0000 6f11 cb7d cae7 b046 5225  ......o..}...FR%
        0x0020:  b01b 0026 0035 01dc 58a0 0102 0007 d186  ...&.5..X.......
        0x0030:  3fc3 2614 014c 184a aac0 3500 5037 483a  ?.&..L.J..5.P7H:
        0x0040:  3500 4253 bd66 3500 401a 4452 3500 c829  5.BS.f5.@.DR5..)
        0x0050:  33e2 3500 c27e 6e82 3500 4416 5aee 3500  3.5..~n.5.D.Z.5.

Regards
Paul Daniel

P.S. Over 24 hours after I sent this it had not appeared in the list, so
this is a resend. Apologies if it ends up appearing twice.

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.795 / Virus Database: 539 - Release Date: 12/11/2004