Re: Unusual DNS requests (not related to previous DNS thread)

From: measl@mfn.org
Date: 01/18/02 

Date: Thu, 17 Jan 2002 20:22:52 -0600 (CST)
From: <measl@mfn.org>
To: Ryan Russell <ryan@securityfocus.com>

On Tue, 15 Jan 2002, Ryan Russell wrote:

> On Mon, 14 Jan 2002 measl@mfn.org wrote:
> > So far, so good. The request is for a PTR
> > record: 0.xxx.xxx.xx.in-addr.arpa. No, that's not a typo, they are
> > requesting reverse for the network address at .0.
>
> Don't get too worried about the 0. part... recall that these are in
> reverse order, so the guy is asking for a name for x.y.z.0.

Yes, I know - look up top :-)

> Or maybe
> that's what you were worried about. It's not common but, depending on
> subnet mask, .0 addresses aren't always reserved.

Sorry I failed to post the mask (/24). And I thoroughly realize that even as
a /24 this is not necessarily an "invalid" request, merely a
"strange" request for a machine not local to the subnet.
 
> > A packet capture shows
> > absolutely nothing out of the ordinary, other than the freaky request, and
> > the regularity of the requests, about one request every five seconds, round
> > the clock.
>
> So this begs the question... is this DNS server supposed to be serving
> in-addr.arpa records?

Why this question (yes, it serves up PTR)?

> I.e. is it reverse for some network addresss range?
> If so, is there a possibility that that network range is a smurf
> amplifier?

I briefly considered this very question, however, they are not using any gear
(only the older 4.3 BSD boxen really had a reputation for doing this,
right?) which responds to this address - I've personally been down this road
with them.

My final guess was (in order) (a) a misconfigured box somehow generating this
valid but nonsensical request (and the customer seeing the request on his
IDS); (b) some kind of discovery mechanism ala' Akamia, Quova, etc...

> Ryan 

-- 
Yours, 
J.A. Terranson
sysadmin@mfn.org

If Governments really want us to behave like civilized human beings, they
should give serious consideration towards setting a better example:
Ruling by force, rather than consensus; the unrestrained application of
unjust laws (which the victim-populations were never allowed input on in
the first place); the State policy of justice only for the rich and 
elected; the intentional abuse and occassionally destruction of entire
populations merely to distract an already apathetic and numb electorate...
This type of demogoguery must surely wipe out the fascist United States
as surely as it wiped out the fascist Union of Soviet Socialist Republics.

The views expressed here are mine, and NOT those of my employers,
associates, or others.  Besides, if it *were* the opinion of all of
those people, I doubt there would be a problem to bitch about in the
first place...
--------------------------------------------------------------------

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: Problem relaying uploads
    ... print reverse($_); # reverse the line, ... Your curl command is totally wrong. ... and issue the request to the server. ...
    (comp.lang.perl.misc)
  • Re: Moussaoui
    ... Does the reverse then apply? ... Is it thus ok for an outside power to change ... Or is it a double-standard, as in "we can do it, but they can't"? ... The key is 'at their request'. ...
    (misc.news.internet.discuss)
  • Re: Inserting a column in the middle of a table using Transact SQL
    ... No, T-SQL doesn't allow this directly, and I'm not sure why this request is ... so common. ... (Reverse address to reply.) ... "Don Miller" wrote in message ...
    (microsoft.public.sqlserver.programming)
  • Re: Juggling Records Database - Official Launch
    ... May I request 3 b reverse back crosses are added to the list? ... Colin E. ...
    (rec.juggling)
  • Re: reverse DNS resolution...
    ... We're trying to get reverse DNS resolution for a block of IPs ... We've had the 10.x network working great at the office ... your DNS needs to be authoritative for both forward and reverse. ... IN PTR user1.vpn. ...
    (freebsd-questions)