[Gllug] NAMED log file entry

[Ken Smith]

Hi Ian,

Thanks that fixed it. I am using MailScanner which was referring to
relays.monkeys.com on its RBL list.

All the best

Ken


-----Original Message-----
From: Ian Northeast [mailto:ian at house-from-hell.demon.co.uk] 
Sent: 16 February 2004 20:59
To: kens at kensnet.org; Greater London Linux Users Group
Subject: Re: [Gllug] NAMED log file entry

Ken Smith wrote:
> Folks, Here is an extract from the logfile of a RH 7.3 machine. Anyone
else
> seeing these messages from BIND?
> 
> I have monitored my network with ethereal and don't see any untoward
> traffic.
> 
> Suggestions welcome
> 
> Ken
> 
> 
> --------------------- Named Begin ------------------------ 
> 
> **Unmatched Entries**
>    internal_send: 244.254.254.254#53: Invalid argument: 545 Time(s)

As it happens someone asked this very question on the bind mailing list 
the other day. Here is the answer from Mark Andrews of the ISC:


 > This is becoming a FAQ.

 > You have a client trying to lookup relays.monkeys.com (a dead
 > anti-spam
 > list) which has a bad server with a CLASS E addressess.

 > * Mark the server as bogus.
 > * Fix the broken MTA generating the queries.

 > Mark

 > server 244.254.254.254 {
 >         bogus yes;
 > };

If you want to find out what machine is generating these queries, turn 
query logging on in your nameserver (send it a WINCH signal). By the 
look of it you won't need to leave it on for long.

Regards, Ian






-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug