nanog mailing list archives

Re: Unusual IN ANY DNS Traffic

From: "Douglas E. Warner" <dwarner () ctinetworks com>
Date: Tue, 10 May 2005 12:23:34 -0400

On Tuesday 10 May 2005 12:14, Duane Wessels wrote:

One thing I've noticed that likes to generate ANY queries is Qmail...


I guess I should've stated that these are almost all some DSL customers on our 
network using their assigned DNS servers, but this traffic is just completely 
out of normal; especially since they were all looking for "msn.com.".
Another thing that is quite odd (to me) is that the source port is all port 
53; I thought that normal clients would use a random high port to do queries 
from.

-Doug

-- 
Douglas E. Warner    <dwarner () ctinetworks com>     Network Engineer
CTI Networks, Inc.   http://www.ctinetworks.com    +1 717 975 9000

Attachment: _bin
Description:

Current thread:

Unusual IN ANY DNS Traffic Douglas E. Warner (May 10)
- Re: Unusual IN ANY DNS Traffic Duane Wessels (May 10)
  - Re: Unusual IN ANY DNS Traffic Douglas E. Warner (May 10)
    - Message not available
    - Re: Unusual IN ANY DNS Traffic Douglas E. Warner (May 11)