Re: DNS help
From: Matt Zimmerman (mdz@csh.rit.edu)
Date: 12/15/02
- Previous message: Joe Stewart: "Re: Logs: Many hits with source port of 80"
- In reply to: larosa, vjay: "RE: DNS help"
- Next in thread: Tom Arseneault: "RE: DNS help"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 15 Dec 2002 17:47:52 -0500 From: Matt Zimmerman <mdz@csh.rit.edu> To: incidents@securityfocus.com
On Thu, Dec 12, 2002 at 02:54:29PM -0500, larosa, vjay wrote:
> That is exactly what I am trying to figure out. What is the meaning
> of '[1au][|domain]'. 56162 is the DNS transaction ID. When a DNS server
> makes a request a number is tagged to it, that way when the reply comes
> back it can match it up with the request. I just don't know what the meaning
> of 1au is.
[|domain] means that only part of the packet was captured, and that it was
truncated while the DNS protocol information was being decoded.
-- - mdz ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
- Next message: Damian Gerow: "Re: Rooted, .haos on system"
- Previous message: Joe Stewart: "Re: Logs: Many hits with source port of 80"
- In reply to: larosa, vjay: "RE: DNS help"
- Next in thread: Tom Arseneault: "RE: DNS help"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
