Security Incidents mailing list archives

source port zero scans against DNS servers


From: dorqus () FREEK COM (dorqus)
Date: Fri, 12 May 2000 09:37:47 -0400


I'm just wondering if I'm the only one seeing these wierd errors.
All 3 of my companies name servers are showing the following in the log
files (/var/adm/messages)

named[3430]: dropping source port zero packet from [209.191.188.93].0
named[3534]: dropping source port zero packet from [63.226.179.7].0
named[20627]: dropping source port zero packet from [206.252.159.146].0

Most of the "attacks" were from the first IP address, 209.191.188.93
which resolves back to 93.dsl.seattle.telisphere.com

All of our name servers are running bind-8.2.2-P5.

Thanks!

--
dorqus



Current thread: