I'm observing TCP connections to port 53 (domain) to our (secondary) name server from unknown locations. ippl.log looks like:
Jun 3 21:51:59 domain connection attempt from [x.x.x.x]
(x.x.x.x:3302->y.y.y.y:53)
As far as I understand, these are not DNS queries since they
are UDP. Is this a break-in attemtp, should I ignore it, how
to prevent it (TCP wrappers don't work here) ... ?
-Igor Mozetic
