Re: Interesting BIND error

[Matthew Sullivan <matthew () sorbs net>]

Brian Bruns wrote:

> On Thu, February 12, 2004 4:52 pm, Brian Wallingford said:
>  
>
> > We've been seeing the following on all of our (9.2.1) authoritative
> > nameservers since approximately 10am today.  Googling has turned up
> > nothing;  I'm currently trying to glean some useful netflow data.  Just
> > wondering if this is local, or if others have suddenly seen the same.
> >
> > Seems harmless enough, but the logging is eating a disproportionate amount
> > of cpu.
> >
> >
> > Feb 12 16:25:07 ns1 named[3150]: internal_send: 244.254.254.254#53:
> > Invalid argument
> >    
>
>
> Its possible that someone is spoofing UDP packets to your nameserver from
> that IP range (which is IANA reserved space).  It looks like BIND is
> refusing to send to that address, and thus the error.
>
> At least, IMHO.  So I could be wrong :)
>
>  
Considering the address range, I'd say it'll have problems sending 
there... multicast anyone?

/ Mat