Malformed DNS or something odd (or just me)

From: Steven Trewick (STrewick_at_joplings.co.uk)
Date: 04/07/04

  • Next message: James C Slora Jr: "RE: Malformed DNS or something odd (or just me)"
    To: incidents@securityfocus.com
    Date: Wed, 7 Apr 2004 14:44:59 +0100
    
    

    Hi list,

    Over the last week or so I have seen what looks (to my untrained eye)
    like some kind of funky, malicious or malformed DNS traffic turning up
    at my network borders.

    I'd appreciate any light that anyone can shed upon the matter,
    largely to satisfy my morbid curiosity and craving for knowledge :-)

    It may be that this is entirely regular traffic, but it doesn't
    look like the kind of traffic I usually see on UDP port 53 (and as for
    the other ports...)

    Much of the action looks like this :

    04/03-20:33:42.525759 62.253.119.103:41601 -> 192.168.0.88:53
    UDP TTL:112 TOS:0x0 ID:53793 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    To me this looks like a DNS query with no host name in it,
    but I am not quite up to speed on this yet, so I appreciate this
    may be incorrect.

    However, this usually comes paired with :

    04/03-20:33:42.506542 62.253.119.103:41601 -> 192.168.0.88:5301
    UDP TTL:112 TOS:0x0 ID:53537 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    Which strikes me as a bit odd, being the same thing but with
    the obvious dest port tomfoolery (some kind of heinous misconfig ?)

    As time goes by, increasing amounts of oddness start to turn up
    via UDP packets, the destination ports of these are 53, 5301
    and, for some reason, 30339. (Which correlates only because some of
    the packets contain exactly the same payload as those on udp ports
    53 and 5301)

    Some of them contain quite large (non text) payloads !

    The sources are mainly unique, there is only one host that sends
    more than one set of packets (scans that didn't get response ???)

    My apologies for posting so much data to the list, but I have been
    googling this backward and forward since 0700 GMT this morning
    with no useful results!

    Help me obe-list-kenobe, you're my only hope ;-)

    Herein follows the full packet dumps of weirdness.

    Possibly important background info :

    1) the sensor is located in the DMZ of a network that offers no
       services at all to the outside world, apart from the occasional
       ACK/RST, all the traffic it receives is unsolicited.

    2) The DNS service in the internal network is provided by a proxy
       service on the NAT router hosting the DMZ, and therefore any
       legit DNS traffic would be routed to/from 192.x.x.x addresses
       (Confirmed by sensor logs)

    3) the ip of the NAT router is dynamically assigned, and does
       change for various reasons, but during the time these packets
       were recorded, it remained the same. (Confirmed from router and
       sensor logs). However, this was a recent shift, the day before
       this trace begins the router was living on a different ip within
       the same class B network.

    4) none of the packets listed were actually delivered into the internal
       network, and there does not appear to be any correlating activity
       internally. Many of these packets were recorded when the sensor was
       the only powered machine on the network.

    5) the sensor is a *nix box running snort, alerts were generated via an
       extremely simple set of research rules that catch and log anything that
       isn't explicitly recognised.

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/03-20:33:42.506542 62.253.119.103:41601 -> 192.168.0.88:5301
    UDP TTL:112 TOS:0x0 ID:53537 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    [**] ** Unknown UDP ** [**]
    04/03-20:33:42.525759 62.253.119.103:41601 -> 192.168.0.88:53
    UDP TTL:112 TOS:0x0 ID:53793 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/03-20:59:33.466087 172.166.14.38:19689 -> 192.168.0.88:53
    UDP TTL:109 TOS:0x0 ID:43520 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/03-21:26:41.210086 62.29.120.15:20578 -> 192.168.0.88:5301
    UDP TTL:111 TOS:0x0 ID:7272 IpLen:20 DgmLen:36
    Len: 8
    01 01 00 B7 DA CB 3F 00 ......?.

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/04-13:51:02.843781 82.41.169.142:3478 -> 192.168.0.88:5301
    UDP TTL:115 TOS:0x0 ID:56342 IpLen:20 DgmLen:538
    Len: 510
    01 02 00 07 D1 86 3F C3 26 14 01 53 9F 94 AC CC ......?.&..S....
    35 00 D5 19 FE 84 35 00 C3 72 5F DB 35 00 18 6A 5.....5..r_.5..j
    7E 8A 35 00 D4 59 6B 02 35 00 C3 4A A9 B8 35 00 ~.5..Yk.5..J..5.
    D3 72 B2 42 35 00 CC 1D DC 51 35 00 3E 41 EC C8 .r.B5....Q5.>A..
    35 00 D9 45 62 52 35 00 42 36 E5 43 35 00 D3 72 5..EbR5.B6.C5..r
    BE 92 35 00 C3 2B 0D 02 35 00 3E 4D 5B C2 35 00 ..5..+..5.>M[.5.
    41 43 09 14 35 00 D4 7A A1 51 35 00 D3 61 85 97 AC..5..z.Q5..a..
    35 00 41 18 06 C4 35 00 43 5E 3A C5 35 00 CC 1D 5.A...5.C^:.5...
    DC F4 35 00 C3 2F 6C DA 35 00 C3 4A AA FC 35 00 ..5../l.5..J..5.
    C8 17 12 66 35 00 CC 1D DC FB 35 00 CC 1D DC 93 ...f5.....5.....
    35 00 CC 1D DC E2 35 00 C3 6D 9C C3 35 00 C8 18 5.....5..m..5...
    D4 16 35 00 CC 1B BC FC 35 00 C8 67 8E 08 35 00 ..5.....5..g..5.
    D8 66 A7 DE 35 00 18 19 04 86 35 00 D3 72 BE E2 .f..5.....5..r..
    35 00 D4 3F 49 12 35 00 D4 7D 68 42 35 00 D3 39 5..?I.5..}hB5..9
    D6 72 35 00 42 3C 85 98 35 00 D3 72 BE AA 35 00 .r5.B<..5..r..5.
    D5 46 6C 03 35 00 C0 66 FD 46 35 00 C3 4D 61 84 .Fl.5..f.F5..Ma.
    35 00 CC 1D DC 16 35 00 9D 19 89 12 35 00 D5 5B 5.....5.....5..[
    88 9C 35 00 C8 17 12 67 35 00 CC 1D DC 08 35 00 ..5....g5.....5.
    41 18 06 E6 35 00 C8 17 12 A3 35 00 D4 7A A1 49 A...5.....5..z.I
    35 00 CF 0A AA 01 35 00 CB 1B 1E E3 35 00 50 37 5.....5.....5.P7
    B2 52 35 00 D3 39 D9 9D 35 00 41 18 06 E4 35 00 .R5..9..5.A...5.
    D1 8B FB B4 35 00 D5 19 EC 72 35 00 D3 72 B2 82 ....5....r5..r..
    35 00 C3 4A A9 D6 35 00 C3 4A A9 F2 35 00 50 37 5..J..5..J..5.P7
    A0 EA 35 00 CB 1B 1E E0 35 00 D4 7A A1 CA 35 00 ..5.....5..z..5.
    C8 36 A9 42 35 00 D3 72 BE C2 35 00 50 30 C8 03 .6.B5..r..5.P0..
    35 00 D3 39 DD D9 35 00 D5 4C 81 62 35 00 CC 1D 5..9..5..L.b5...
    DC 74 35 00 D4 7A 2A 03 35 00 D4 7A A1 CC 35 00 .t5..z*.5..z..5.
    40 1A A9 C2 35 00 D2 1A 90 82 35 00 CB 1B 1E EC @...5.....5.....
    35 00 CC 1D DC 34 35 00 CC 1D DC 0E 35 00 CC 1D 5....45.....5...
    DC 7E 35 00 D9 45 62 5A 35 00 41 55 F0 8A 35 00 .~5..EbZ5.AU..5.
    D5 46 6C 02 35 00 CA 63 1E 52 35 00 D4 7A A7 81 .Fl.5..c.R5..z..
    35 00 CB 1B 1E E5 35 00 D5 19 FE FD 35 00 5.....5.....5.

    [**] ** Unknown UDP ** [**]
    04/04-13:51:02.852266 82.41.169.142:3478 -> 192.168.0.88:5301
    UDP TTL:115 TOS:0x0 ID:56598 IpLen:20 DgmLen:538
    Len: 510
    01 02 00 07 D1 86 3F C3 26 14 01 53 89 5C 61 07 ......?.&..S.\a.
    35 00 C1 4D 9E 32 35 00 43 5E 3A C3 35 00 D8 66 5..M.25.C^:.5..f
    A7 BE 35 00 D3 39 DD C3 35 00 18 78 2A 02 35 00 ..5..9..5..x*.5.
    CC 1D DC 66 35 00 C3 4A AB 53 35 00 D9 45 62 5C ...f5..J.S5..Eb\
    35 00 41 18 06 E8 35 00 C0 75 A5 A3 35 00 CC 1D 5.A...5..u..5...
    DC DB 35 00 C3 4A A9 6B 35 00 C3 29 07 D0 35 00 ..5..J.k5..)..5.
    C3 38 B5 7D 35 00 C1 44 27 01 35 00 D9 05 B4 81 .8.}5..D'.5.....
    35 00 A4 4D D3 C8 35 00 CE 42 F1 C8 35 00 50 31 5..M..5..B..5.P1
    17 98 35 00 D9 7A 61 BF 35 00 D9 60 F4 23 35 00 ..5..za.5..`.#5.
    40 1A A9 1E 35 00 D9 60 0B 62 35 00 43 5E 3A C4 @...5..`.b5.C^:.
    35 00 44 0F A8 07 35 00 CB 6A 5B D2 35 00 D4 6A 5.D...5..j[.5..j
    86 2E 35 00 50 37 BD 4E 35 00 D3 39 D6 9A 35 00 ..5.P7.N5..9..5.
    94 51 F4 05 35 00 C3 41 2A 03 35 00 D4 3B 1E 85 .Q..5..A*.5..;..
    35 00 CC 1D DC 27 35 00 C3 4A A9 7B 35 00 CC 1D 5....'5..J.{5...
    DC 40 35 00 C3 4A A9 12 35 00 3E 49 63 6D 35 00 .@5..J..5.>Icm5.
    3D 64 85 46 35 00 D3 72 C4 9D 35 00 D9 45 62 5D =d.F5..r..5..Eb]
    35 00 42 7C 3F C2 35 00 C3 4A AA 62 35 00 C3 4A 5.B|?.5..J.b5..J
    A9 33 35 00 C2 52 EF 02 35 00 C3 29 07 CC 35 00 .35..R..5..)..5.
    3E 99 C8 EA 35 00 D3 72 B2 6A 35 00 18 78 2A 15 >...5..r.j5..x*.
    35 00 C3 67 EA 03 35 00 41 18 06 C2 35 00 C3 4A 5..g..5.A...5..J
    A9 D5 35 00 82 5E A2 89 35 00 D3 72 BE 52 35 00 ..5..^..5..r.R5.
    18 19 04 7C 35 00 41 18 06 EE 35 00 C3 4A AA 53 ...|5.A...5..J.S
    35 00 C3 4A A9 BA 35 00 CB 1B 1E E9 35 00 40 4B 5..J..5.....5.@K
    BC DA 35 00 51 07 4A E3 35 00 C3 4A A9 76 35 00 ..5.Q.J.5..J.v5.
    50 35 A0 4C 35 00 C3 4A AA 4E 35 00 D2 52 33 63 P5.L5..J.N5..R3c
    35 00 C3 75 AE 82 35 00 C3 4A A9 6F 35 00 C0 75 5..u..5..J.o5..u
    A5 A2 35 00 50 31 74 58 35 00 D5 4D BC 7E 35 00 ..5.P1tX5..M.~5.
    C3 4A AB 87 35 00 3E 4D 5B 0A 35 00 C3 4A A8 F3 .J..5.>M[.5..J..
    35 00 40 73 94 98 35 00 CE 42 24 C2 35 00 44 9D 5.@s..5..B$.5.D.
    AB 05 35 00 C1 FB 28 C9 35 00 C8 48 1F A2 35 00 ..5...(.5..H..5.
    C2 2F 5E 44 35 00 3F 7B A4 6B 35 00 C8 36 B3 33 ./^D5.?{.k5..6.3
    35 00 CB 7C 8A C4 35 00 C0 4C 9D 09 35 00 5..|..5..L..5.
    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/04-15:45:39.331413 200.52.217.103:17586 -> 192.168.0.88:5301
    UDP TTL:106 TOS:0x0 ID:40964 IpLen:20 DgmLen:49
    Len: 21
    01 03 00 FE D0 84 3F 26 00 08 C3 26 14 01 01 18 ......?&...&....
    52 22 46 49 5A R"FIZ

    [**] ** Unknown UDP ** [**]
    04/04-15:45:39.331430 200.52.217.103:17586 -> 192.168.0.88:5301
    UDP TTL:106 TOS:0x0 ID:41220 IpLen:20 DgmLen:49
    Len: 21
    01 03 00 FE D0 84 3F 26 00 08 C3 26 14 01 01 18 ......?&...&....
    52 22 46 49 5A R"FIZ

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/04-16:29:35.844956 68.108.151.154:13583 -> 192.168.0.88:5301
    UDP TTL:107 TOS:0x0 ID:48713 IpLen:20 DgmLen:46
    Len: 18
    01 02 00 07 D1 86 3F C3 26 14 01 01 40 20 C6 3E ......?.&...@ .>
    35 00 5.

    [**] ** Unknown UDP ** [**]
    04/04-16:29:35.846179 68.108.151.154:13583 -> 192.168.0.88:5301
    UDP TTL:107 TOS:0x0 ID:48714 IpLen:20 DgmLen:46
    Len: 18
    01 02 00 07 D1 86 3F C3 26 14 01 01 40 20 C6 3E ......?.&...@ .>
    35 00 5.

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/04-17:19:35.075968 65.235.142.247:30099 -> 192.168.0.88:53
    UDP TTL:106 TOS:0x0 ID:41812 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/04-17:24:32.152380 172.128.205.42:11666 -> 192.168.0.88:5301
    UDP TTL:109 TOS:0x0 ID:4160 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    [**] ** Unknown UDP ** [**]
    04/04-17:24:32.160026 172.128.205.42:11666 -> 192.168.0.88:5301
    UDP TTL:109 TOS:0x0 ID:4161 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/04-17:31:56.486199 80.9.89.99:10352 -> 192.168.0.88:53
    UDP TTL:108 TOS:0x0 ID:17451 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/05-19:30:53.683363 83.152.103.217:4404 -> 192.168.0.88:5301
    UDP TTL:110 TOS:0x0 ID:14618 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/05-21:15:33.571071 80.160.229.106:21047 -> 192.168.0.88:30339
    UDP TTL:110 TOS:0x0 ID:37144 IpLen:20 DgmLen:106
    Len: 78
    01 02 00 07 D1 86 3F C3 26 14 01 0B C3 4C 06 03 ......?.&....L..
    35 00 C1 FB 5B 1C 35 00 D1 63 E0 06 35 00 D0 39 5...[.5..c..5..9
    6B 83 35 00 D8 BB F5 29 35 00 C8 0D E4 F2 35 00 k.5....)5.....5.
    A5 62 0C 04 35 00 D4 3B 06 C2 35 00 CB 4D E6 E4 .b..5..;..5..M..
    35 00 C3 2F 26 12 35 00 42 5B 8C 1B 35 00 5../&.5.B[..5.

    [**] ** Unknown UDP ** [**]
    04/05-21:15:33.575523 80.160.229.106:21047 -> 192.168.0.88:53
    UDP TTL:110 TOS:0x0 ID:37400 IpLen:20 DgmLen:106
    Len: 78
    01 02 00 07 D1 86 3F C3 26 14 01 0B C3 4C 06 03 ......?.&....L..
    35 00 C1 FB 5B 1C 35 00 D1 63 E0 06 35 00 D0 39 5...[.5..c..5..9
    6B 83 35 00 D8 BB F5 29 35 00 C8 0D E4 F2 35 00 k.5....)5.....5.
    A5 62 0C 04 35 00 D4 3B 06 C2 35 00 CB 4D E6 E4 .b..5..;..5..M..
    35 00 C3 2F 26 12 35 00 42 5B 8C 1B 35 00 5../&.5.B[..5.

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/06-18:20:45.410884 172.190.203.135:15536 -> 192.168.0.88:53
    UDP TTL:114 TOS:0x0 ID:46113 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/06-18:42:38.668254 68.108.151.154:13583 -> 192.168.0.88:5301
    UDP TTL:107 TOS:0x0 ID:24694 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    [**] ** Unknown UDP ** [**]
    04/06-18:42:38.672874 68.108.151.154:13583 -> 192.168.0.88:53
    UDP TTL:107 TOS:0x0 ID:24695 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/06-19:44:45.549518 193.198.146.51:20329 -> 192.168.0.88:30339
    UDP TTL:108 TOS:0x0 ID:5682 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...

    [**] ** Unknown UDP ** [**]
    04/06-19:44:45.558207 193.198.146.51:20329 -> 192.168.0.88:30339
    UDP TTL:108 TOS:0x0 ID:5683 IpLen:20 DgmLen:40
    Len: 12
    01 02 00 07 D1 86 3F C3 26 14 01 00 ......?.&...
    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    [**] ** Unknown UDP ** [**]
    04/06-20:22:31.856639 24.213.243.68:9246 -> 192.168.0.88:5301
    UDP TTL:110 TOS:0x0 ID:33041 IpLen:20 DgmLen:100
    Len: 72
    01 02 00 07 D1 86 3F C3 26 14 01 0A D0 B1 C1 33 ......?.&......3
    35 00 D4 21 23 6E 35 00 40 3B 3C 1E 35 00 42 2B 5..!#n5.@;<.5.B+
    85 F2 35 00 97 63 F8 4B 35 00 D1 2C 91 D2 35 00 ..5..c.K5..,..5.
    D1 2C 91 F0 35 00 18 7F B1 C9 35 00 D1 2C 91 EF .,..5.....5..,..
    35 00 D5 1C 83 D2 35 00 5.....5.

    [**] ** Unknown UDP ** [**]
    04/06-20:22:31.862015 24.213.243.68:9246 -> 192.168.0.88:53
    UDP TTL:110 TOS:0x0 ID:33042 IpLen:20 DgmLen:100
    Len: 72
    01 02 00 07 D1 86 3F C3 26 14 01 0A D0 B1 C1 33 ......?.&......3
    35 00 D4 21 23 6E 35 00 40 3B 3C 1E 35 00 42 2B 5..!#n5.@;<.5.B+
    85 F2 35 00 97 63 F8 4B 35 00 D1 2C 91 D2 35 00 ..5..c.K5..,..5.
    D1 2C 91 F0 35 00 18 7F B1 C9 35 00 D1 2C 91 EF .,..5.....5..,..
    35 00 D5 1C 83 D2 35 00 5.....5.

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    </code>
    The information contained in this e-mail is confidential and may be privileged, it is intended for the addressee only. If you have received this e-mail in error please delete it from your system. The statements and opinions expressed in this message are those of the author and do not necessarily reflect those of the company. Whilst Joplings Group operates an e-mail anti-virus program it does not accept responsibility for any damage whatsoever that is caused by viruses being passed.
    joplings.co.uk

    ---------------------------------------------------------------------------
    Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
    wireless security

    Protect your network against hackers, viruses, spam and other risks with Astaro
    Security Linux, the comprehensive security solution that combines six
    applications in one software solution for ease of use and lower total cost of
    ownership.

    Download your free trial at
    http://www.securityfocus.com/sponsor/Astaro_incidents_040301
    ----------------------------------------------------------------------------


  • Next message: James C Slora Jr: "RE: Malformed DNS or something odd (or just me)"