North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Unusual IN ANY DNS Traffic

  • From: Douglas E. Warner
  • Date: Tue May 10 12:24:56 2005

On Tuesday 10 May 2005 12:14, Duane Wessels wrote:
> One thing I've noticed that likes to generate ANY queries is Qmail...

I guess I should've stated that these are almost all some DSL customers on our 
network using their assigned DNS servers, but this traffic is just completely 
out of normal; especially since they were all looking for "msn.com.".
Another thing that is quite odd (to me) is that the source port is all port 
53; I thought that normal clients would use a random high port to do queries 
from.

-Doug

-- 
Douglas E. Warner    <[email protected]>     Network Engineer
CTI Networks, Inc.   http://www.ctinetworks.com    +1 717 975 9000

Attachment: pgp00009.pgp
Description: PGP signature