[67567] in North American Network Operators' Group
Re: Interesting BIND error
daemon@ATHENA.MIT.EDU (Brian Bruns)
Thu Feb 12 17:32:32 2004
In-Reply-To: <Pine.GSO.4.58.0402121626450.4611@evccyr>
Date: Thu, 12 Feb 2004 17:31:52 -0500 (EST)
From: "Brian Bruns" <bruns@2mbit.com>
To: "Brian Wallingford" <brian@meganet.net>
Cc: nanog@merit.edu
X-SA-Exim-Mail-From: bruns@2mbit.com
Errors-To: owner-nanog-outgoing@merit.edu
On Thu, February 12, 2004 4:52 pm, Brian Wallingford said:
>
> We've been seeing the following on all of our (9.2.1) authoritative
> nameservers since approximately 10am today. Googling has turned up
> nothing; I'm currently trying to glean some useful netflow data. Just
> wondering if this is local, or if others have suddenly seen the same.
>
> Seems harmless enough, but the logging is eating a disproportionate amount
> of cpu.
>
>
> Feb 12 16:25:07 ns1 named[3150]: internal_send: 244.254.254.254#53:
> Invalid argument
Its possible that someone is spoofing UDP packets to your nameserver from
that IP range (which is IANA reserved space). It looks like BIND is
refusing to send to that address, and thus the error.
At least, IMHO. So I could be wrong :)
--
Brian Bruns
The Summit Open Source Development Group
Open Solutions For A Closed World / Anti-Spam Resources
http://www.sosdg.org
The AHBL - http://www.ahbl.org
