strange query
Bill Manning
bmanning at ISI.EDU
Wed Aug 23 15:39:57 UTC 2000
%
% Could this be an attack, or is something like that considered normal
% (never saw it bevore).
%
% Aug 23 13:04:12 box named[7349]: bad referral (253.243.225.193.in-addr.arpa !< 25\003193\007in-addr\004arpa\000\000\012\000\001\192\021\000\002\000\001\000\001Ix\000\019\009blackhole\003isi.edu)
% Aug 23 13:04:14 box named[7349]: bad referral (253.243.225.193.in-addr.arpa !< 25\003193\007in-addr\004arpa\000\000\012\000\001\192\021\000\002\000\001\000\001Iv\000\019\009blackhole\003isi.edu)
%
% This box runs bind 8.2.2-p5
%
Perhaps. Blackhole.isi.edu is an authorized server in the
Internet for RFC 1918 space. It acts to help folks identify
leaks in their firewalls. In this case, it appears blackhole
received a query for private network space and is attempting
to respond. You likely have a misconfigured firewall.
--
--bill
More information about the bind-users
mailing list