[67573] in North American Network Operators' Group
Re: Interesting BIND error
daemon@ATHENA.MIT.EDU (Crist Clark)
Thu Feb 12 18:08:56 2004
Date: Thu, 12 Feb 2004 14:59:40 -0800
From: Crist Clark <crist.clark@globalstar.com>
In-reply-to: <1821.172.145.135.129.1076625112.squirrel@172.145.135.129>
To: Brian Bruns <bruns@2mbit.com>
Cc: Brian Wallingford <brian@meganet.net>, nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
Brian Bruns wrote:
>
> On Thu, February 12, 2004 4:52 pm, Brian Wallingford said:
>
>>We've been seeing the following on all of our (9.2.1) authoritative
>>nameservers since approximately 10am today. Googling has turned up
>>nothing; I'm currently trying to glean some useful netflow data. Just
>>wondering if this is local, or if others have suddenly seen the same.
>>
>>Seems harmless enough, but the logging is eating a disproportionate amount
>>of cpu.
>>
>>
>>Feb 12 16:25:07 ns1 named[3150]: internal_send: 244.254.254.254#53:
>>Invalid argument
>
>
>
> Its possible that someone is spoofing UDP packets to your nameserver from
> that IP range (which is IANA reserved space).
That's the old Class E space. Definately not routed over the Internet.
> It looks like BIND is
> refusing to send to that address, and thus the error.
Or the OS is.
--
Crist J. Clark crist.clark@globalstar.com
Globalstar Communications (408) 933-4387
