[80739] in North American Network Operators' Group
Re: DNS requests and Bandwidth
daemon@ATHENA.MIT.EDU (Steven J. Sobol)
Wed May 11 14:04:59 2005
Date: Wed, 11 May 2005 14:01:24 -0400 (EDT)
From: "Steven J. Sobol" <sjsobol@JustThe.net>
To: Gadi Evron <ge@linuxbox.org>
Cc: aljuhani <info@riyadmail.com>, <nanog@nanog.org>
In-Reply-To: <428229BF.2010301@linuxbox.org>
Errors-To: owner-nanog@merit.edu
On Wed, 11 May 2005, Gadi Evron wrote:
> > 14:40:09.407336 212.26.72.85.34997 > ns.MyNameServer.net.domain: 51794 MX? MyDomain.com. (29)(DF)
> > 14:40:09.411707 212.26.72.85.34997 > ns.MyNameServer.net.domain: 14233 A? MyDomain.com. (29) (DF)
> > 14:40:09.415880 212.26.72.85.34997 > ns.MyNameServer.net.domain: 39317 MX? MyDomain.com. (29) (DF)
> > 14:40:09.419827 212.26.72.85.34997 > ns.MyNameServer.net.domain: 49503 A? MyDomain.com. (29) (DF)
> > 14:40:09.423700 212.26.72.85.34997 > ns.MyNameServer.net.domain: 29362 A? MyDomain.com. (29) (DF)
> > 14:40:09.426963 212.26.72.85.34997 > ns.MyNameServer.net.domain: 16692 A? MyDomain.com. (29) (DF)
> > 14:40:09.430590 212.26.72.85.34997 > ns.MyNameServer.net.domain: 65288 A? MyDomain.com. (29) (DF)
> > 14:40:09.434350 212.26.72.85.34997 > ns.MyNameServer.net.domain: 1341 A? MyDomain.com. (29) (DF)
> > 14:40:09.438163 212.26.72.85.34997 > ns.MyNameServer.net.domain: 57932 A? MyDomain.com. (29) (DF)
>
> As happy as I'd be to go and yell DoS!! (I love that word)... there are
> other possibilities here.
The one time this happened to a DNS server for which I was responsible, it
was a misconfigured Windows 2000 server with Active Directory installed.
"myNameServer.net" is a generic enough domain name that someone might have
used it as an example in a HOWTO document on setting up AD.
(just a thought, FWIW)
--
JustThe.net - Apple Valley, CA - http://JustThe.net/ - 888.480.4NET (4638)
Steven J. Sobol, Geek In Charge / sjsobol@JustThe.net / PGP: 0xE3AE35ED
"The wisdom of a fool won't set you free"
--New Order, "Bizarre Love Triangle"
