On Fri, May 26, 2000 at 10:59:31AM +1000, Dan Horth wrote:
> Hiya - two staged problem / question here...
>
> we use logcheck to monitor our logfiles and are getting a lot of
> errors like this being reported:
>
> May 26 10:31:43 named[511]: bad referral (228.165.in-addr.arpa !<
> 132.228.165.IN-ADDR.ARPA)
> May 26 10:31:45 named[511]: bad referral (228.165.in-addr.arpa !<
> 130.228.165.IN-ADDR.ARPA)
>
> someone on the list suggested that it was a sign that we were having
> people trying to hack a bind vulnerability but it doesn't seem like
> that to me.
This may be one explanation, but not the only one. I get these too,
and have port 53 completely blocked to the outside. (Not running squid
either, BTW.)
--
Hal B
[EMAIL PROTECTED]
--
--
To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
as the Subject.
