Re: Bogus DNS traffic

[Brian Collins <listbc () newnanutilities org>]

>   I'm seeing random UDP packets to port 53 of random
> internal IP addresses.  The source IP addresses are
> external, all over the map, although the one example
> I've gotten a good capture of bore the source MAC
> address of an internal server.  (Whatever is spoofing
> the IP address *could* be spoofing the MAC address, but
> that would still indicate an origin inside our network....)
>
>   Does anyone recognize this?

Check here...
http://isc.sans.org/diary.html

What you're seeing might be the same.
--Brian Collins


---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_incidents_031015
----------------------------------------------------------------------------