Unusually large number of lame log entries.
Chris Meadors
bind at clubneon.com
Thu Feb 8 20:04:02 UTC 2001
I know what the "lame server on" message is about in my logs, and it
doesn't usually bother me.
But after seeing my log hit 128 MB yesterday I figured something was up.
I saw entry after entry of these three lines:
lame server on 'www.feblue.org' (in 'FEBLUE.ORG'?): 65.192.28.21#53
lame server on 'danzig.net' (in 'danzig.NET'?): 216.74.154.251#53
lame server on 'www.suntrustbank.com' (in 'SUNTRUSTBANK.com'?): 209.3.201.6#53
Running tcpdump with host set to the IP address listed at the end of the
line shows about 3 or 4 requests coming from that machine's port 53 a
second.
That is insane, what is going on? I've turned off the logging of
lame-servers, but that doesn't stop the requests. "top" shows named at
the top of the list constantly.
-Chris
--
Two penguins were walking on an iceberg. The first penguin said to the
second, "you look like you are wearing a tuxedo." The second penguin
said, "I might be..." --David Lynch, Twin Peaks
More information about the bind-users
mailing list