[Gllug] NAMED log file entry

Ian Northeast ian at house-from-hell.demon.co.uk
Mon Feb 16 20:59:27 UTC 2004

Ken Smith wrote:
> Folks, Here is an extract from the logfile of a RH 7.3 machine. Anyone else
> seeing these messages from BIND?
> I have monitored my network with ethereal and don't see any untoward
> traffic.
> Suggestions welcome
> Ken
> --------------------- Named Begin ------------------------ 
> **Unmatched Entries**
>    internal_send: Invalid argument: 545 Time(s)

As it happens someone asked this very question on the bind mailing list 
the other day. Here is the answer from Mark Andrews of the ISC:

 > This is becoming a FAQ.

 > You have a client trying to lookup relays.monkeys.com (a dead
 > anti-spam
 > list) which has a bad server with a CLASS E addressess.

 > * Mark the server as bogus.
 > * Fix the broken MTA generating the queries.

 > Mark

 > server {
 >         bogus yes;
 > };

If you want to find out what machine is generating these queries, turn 
query logging on in your nameserver (send it a WINCH signal). By the 
look of it you won't need to leave it on for long.

Regards, Ian

Gllug mailing list  -  Gllug at gllug.org.uk

More information about the GLLUG mailing list