Re: Question about strain on the A root server

[jlewis () lewis org]

On Sat, 22 Apr 2000, Dirk Harms-Merbitz wrote:

> That's what we thought initially. Somebody processing logfiles.
>
> Doesn't look like it though. A remote machine makes our top ten
> list and then stays there for days. If we block on a router level
> then it seems to get fixed eventually on the other end.

If you're looking at the stats enough to pin down heavy usage to
individual systems, it shouldn't be too much more work to track down why
they're suddenly making the top ten list.  i.e. is it a bug in their
resolver, or were they hacked and running some scanner kit that makes
heavy use of DNS, with A hard-coded into the scanner?

----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |  
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________