Re: Interesting BIND error

From: Matthew Sullivan (no email)
Date: Thu Feb 12 2004 - 17:55:14 EST


Brian Bruns wrote:

>On Thu, February 12, 2004 4:52 pm, Brian Wallingford said:
>
>
>>We've been seeing the following on all of our (9.2.1) authoritative
>>nameservers since approximately 10am today. Googling has turned up
>>nothing; I'm currently trying to glean some useful netflow data. Just
>>wondering if this is local, or if others have suddenly seen the same.
>>
>>Seems harmless enough, but the logging is eating a disproportionate amount
>>of cpu.
>>
>>
>>Feb 12 16:25:07 ns1 named[3150]: internal_send: 244.254.254.254#53:
>>Invalid argument
>>
>>
>
>
>Its possible that someone is spoofing UDP packets to your nameserver from
>that IP range (which is IANA reserved space). It looks like BIND is
>refusing to send to that address, and thus the error.
>
>At least, IMHO. So I could be wrong :)
>
>
>
Considering the address range, I'd say it'll have problems sending
there... multicast anyone?

/ Mat








Hosted Email Solutions

Invaluement Anti-Spam DNSBLs



Powered By FreeBSD   Powered By FreeBSD