Re: DNS/Blackhole-1.Iana.Org in NT Security Log

From: Michael Suski (msuski@vuteq.on.ca)
Date: 03/25/02

  • Next message: Bruce Bradbury \(remove XXX\): "Bypass Traverse Checking not working" 

    From: msuski@vuteq.on.ca (Michael Suski)
Date: 25 Mar 2002 12:28:10 -0800

    Looks like blackhole-1.iana.org has taken over for blackhole.isi.edu.

    See http://support.microsoft.com/support/kb/articles/Q259/9/22.ASP?LN=EN-US&SD=gn&FR=0

    I had a very similar issue. I also had a new domain pop up in my
    Win2K network neighbourhood. I believe they are related. I tracked
    it back to a new laptop hooking into our network with settings from
    another organization. It had an IP subnet mask of 10.x.x.x instead of
    our 192.168.x.x, and it looks like if there is no reverse lookup zone
    for 10.x.x.x in your domain, it goes to the internet and is trapped by
    iana.org. The above technet article provides more details.

    Post back to indicate success or not.

    Michael

    raz230@yahoo.com (rob) wrote in message news:<efd23b97.0203190755.1c02c0a1@posting.google.com>...
    > I dont know if this is the right place to post this message, and it's
    > my first post here...
    >
    > I have recently (in the last 2 weeks) started seeing odd messages in
    > the security log on our windows 2000 server.
    >
    > Here is a sample entry:
    > Service Ticket Request Failed:
    > User Name: <the server name is here>$
    > User Domain: <my domain name is here>
    > Service Name: DNS/blackhole-1.iana.org
    > Ticket Options: 0x40810010
    > Failure Code: 0x7
    > Client Address: 127.0.0.1
    >