RE: TCP DNS requests

[<Leonard.Ong () nokia com>]

Yes, I am confirming this. Zone transfer uses TCP/53, while queries use UDP/53.


Regards,
Leonard Ong
Network Security Specialist, APAC
NOKIA

Email.  Leonard.Ong () nokia com
Mobile. +65 9431 6184
Phone.  +65 6723 1724
Fax.    +65 6723 1596



-----Original Message-----
From: ext Daniel Miessler [mailto:danielrm26 () hotmail com]
Sent: Friday, November 01, 2002 1:20 AM
To: 'Carl R Diliberto'; 'security-basics'
Subject: RE: TCP DNS requests


Zone Transfers use TCP instead of UDP on port 53.  That is most likely
what you are seeing.

--Daniel

> We are reporting TCP based DNS requests to one of our DNS servers
coming
> from internal, client IP addresses.  My manager would like to block
the TCP
> packets.  What or why would their be random TCP packets?  We monitored
> several clients and it appears it only needs UDP.