[Gllug] NAMED log file entry

[Ian Northeast]

Ken Smith wrote:
> Folks, Here is an extract from the logfile of a RH 7.3 machine. Anyone else
> seeing these messages from BIND?
> 
> I have monitored my network with ethereal and don't see any untoward
> traffic.
> 
> Suggestions welcome
> 
> Ken
> 
> 
> --------------------- Named Begin ------------------------ 
> 
> **Unmatched Entries**
>    internal_send: 244.254.254.254#53: Invalid argument: 545 Time(s)

As it happens someone asked this very question on the bind mailing list 
the other day. Here is the answer from Mark Andrews of the ISC:


 > This is becoming a FAQ.

 > You have a client trying to lookup relays.monkeys.com (a dead
 > anti-spam
 > list) which has a bad server with a CLASS E addressess.

 > * Mark the server as bogus.
 > * Fix the broken MTA generating the queries.

 > Mark

 > server 244.254.254.254 {
 >         bogus yes;
 > };

If you want to find out what machine is generating these queries, turn 
query logging on in your nameserver (send it a WINCH signal). By the 
look of it you won't need to leave it on for long.

Regards, Ian





-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug