Strange error in logs

Chris Hanlon chanlon at mergetel.com
Fri Aug 6 18:00:00 UTC 2004


For the last couple of weeks I've been getting messages like these in my
message log:

Aug  6 13:02:49 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [216.52.184.230].53
Aug  6 13:02:53 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [63.251.163.102].53
Aug  6 13:02:53 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [216.52.184.230].53
Aug  6 13:02:57 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [63.251.163.102].53
Aug  6 13:02:59 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [63.251.83.36].53
Aug  6 13:03:03 mergex last message repeated 1 time
Aug  6 13:03:17 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [64.74.96.242].53
Aug  6 13:03:21 mergex last message repeated 1 time
Aug  6 13:03:35 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [212.118.243.118].53
Aug  6 13:03:39 mergex last message repeated 1 time
Aug  6 13:03:53 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [216.52.184.230].53
Aug  6 13:03:57 mergex last message repeated 1 time
Aug  6 13:04:01 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [63.251.163.102].53
Aug  6 13:04:05 mergex last message repeated 1 time
Aug  6 13:04:13 mergex named[26439]: [ID 295310 daemon.notice] refused query
on non-query socket from [63.251.83.36].53
Aug  6 13:04:17 mergex last message repeated 1 time

They're nothing I've ever seen before - and I have them showing up at the
same times in the message logs of 2 of the 3 DNS servers I maintain ... and
never on the 3rd one.

The IP addresses are always the same 5, according to ARIN they all are part
of netblocks owned by InterNAP and I think most are delegated to eNOM.

Any idea what they are?  And should I do anything to my config to deal with
them?  (Running BIND 8.1.2 on one and  9.2.1 on the other.)





More information about the bind-users mailing list