North American Network Operators Group|
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical
Re: Interesting BIND error
Brian Wallingford wrote:
Hmm. A few weeks ago I started noticing some similiar messages that I had not ever seen before:Feb 12 16:25:07 ns1 named: socket.c:1100: unexpected error:
Jan 29 18:21:52 named: socket.c:1100: unexpected error:
Jan 29 18:21:52 named: internal_send: 188.8.131.52#39254: Connection reset by peer
Jan 29 18:21:53 named: client 184.108.40.206#39254: error sending response: connection reset
On closer examination I could see that the remote client was attempting DDNS updates to a zone that server was auth for.
It started Jan 29 03:19:39 MDT and then mysteriously ended Jan 31 11:06:11 MDT which I thought was a little odd. Usually someone sticks a domain name that they like (but have no real relationship to) into their Microsoft TCP/IP stack's domain name field and it tries to do it's Active Directory update thingy forever (we have 'clark.com' which is lots of fun). So once a client starts sending us updates, it's not likely to ever stop.
FWIW, only a small percentage of the updates were generating this error....
# grep -c '220.127.116.11.*denied' messages.2
# grep -c socket.c messages.2