Re: FW: [Full-Disclosure] Question for DNS pros

From: Frank Knobbe (frank_at_knobbe.us)
Date: 08/04/04

  • Next message: grutz_at_jingojango.net: "Re: FW: [Full-Disclosure] Question for DNS pros"
    To: fd@mchsi.com
    Date: Tue, 03 Aug 2004 18:20:52 -0500
    
    
    

    On Tue, 2004-08-03 at 17:52, Frank Knobbe wrote:

    > 216.154.239.240 - SBC in Irvine
      --> couldn't confirm that one
    > 66.150.165.7 - Logical US-AWS NAP through Internap
      --> seadns01.shopattwireless.com (match)
    > 64.170.177.10 - SBC Interactive through PacBell
      --> 64-170-177-10.ptim.com (match)
    > 63.240.26.10 - CERFnet
      --> ny-ns.marketwatch.com (match)
    > 63.210.252.135 - Level 3
      --> cindns01.shopattwireless.com (match)

    (match means it is the exact same traffic, just a low volume, between 3
    and 10 packets total).

    It appears all these are DNS servers. They also all respond to queries
    for "." with the list of root servers. That means that they are
    recursive.

    Perhaps there is a 0-day exploit for certain DNS servers? Maybe those
    DNS servers have a worm that is trying to spread? Maybe seeded from
    China? Otherwise, why would AT&T's name server be sending out probes?

    The mystery deepens...

    Regards,
    Frank

    
    

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html



  • Next message: grutz_at_jingojango.net: "Re: FW: [Full-Disclosure] Question for DNS pros"

    Relevant Pages

    • Re: FW: [Full-Disclosure] Question for DNS pros
      ... most sites use local forwarding DNS servers that do the ... What is strange, though, is the fact that the load-balancer sent those ... packets without actually receiving a request. ... load-balancer is just unsolicited probes. ...
      (Full-Disclosure)
    • Re: FW: [Full-Disclosure] Question for DNS pros
      ... but most DNS servers *will* respond with a RST which is just as ... >that allows your 3DNS probes to be ignored, but not render the IDS ... that our customers only configure two probe methods. ...
      (Full-Disclosure)