Re: DNS/Blackhole-1.Iana.Org in NT Security Log

From: rob (raz230@yahoo.com)
Date: 03/31/02 

From: raz230@yahoo.com (rob)
Date: 31 Mar 2002 07:35:06 -0800

Thanks alot! I looked up that article from the link you posted and I
just added a reverse lookup zone. That actually seems to have stopped
it. I'm keeping an eye on it and will let you know if I had to do
anything else.

Thanks again-- I appreciate it!

msuski@vuteq.on.ca (Michael Suski) wrote in message news:<abc38382.0203251228.349029b3@posting.google.com>...
> Looks like blackhole-1.iana.org has taken over for blackhole.isi.edu.
>
> See http://support.microsoft.com/support/kb/articles/Q259/9/22.ASP?LN=EN-US&SD=gn&FR=0
>
> I had a very similar issue. I also had a new domain pop up in my
> Win2K network neighbourhood. I believe they are related. I tracked
> it back to a new laptop hooking into our network with settings from
> another organization. It had an IP subnet mask of 10.x.x.x instead of
> our 192.168.x.x, and it looks like if there is no reverse lookup zone
> for 10.x.x.x in your domain, it goes to the internet and is trapped by
> iana.org. The above technet article provides more details.
>
> Post back to indicate success or not.
>
> Michael
>
> raz230@yahoo.com (rob) wrote in message news:<efd23b97.0203190755.1c02c0a1@posting.google.com>...
> > I dont know if this is the right place to post this message, and it's
> > my first post here...
> >
> > I have recently (in the last 2 weeks) started seeing odd messages in
> > the security log on our windows 2000 server.
> >
> > Here is a sample entry:
> > Service Ticket Request Failed:
> > User Name: <the server name is here>$
> > User Domain: <my domain name is here>
> > Service Name: DNS/blackhole-1.iana.org
> > Ticket Options: 0x40810010
> > Failure Code: 0x7
> > Client Address: 127.0.0.1
> >