Yep, that was it (SOA and AXFR queries). Thanks!
Jade Roberts
WSRC - ITD/Network Operations
803-725-0210 Pager 11089
Jim Reid
<jim at rfc1035. To: jade.roberts at mailhub.srs.gov
com> cc: bind-users at isc.org
Subject: Re: IP/TCP connection log message
04/05/00
12:20
>>>>> "jade" == jade roberts <jade.roberts at srs.gov> writes:
jade> Checked http://www.acmebw.com/askmrdns/bind-messages.htm but
jade> didn't see an entry for:
jade> 31-Mar-2000 13:52:18.771 info: IP/TCP connection from
[192.68.250.6].43378 (fd 9)
jade> Any ideas what the connections might be for?
Zone transfers most likely though it could be a resolver that uses TCP
for its DNS lookups. Try enabling the name server's query logs. This'll
show you what, if anything, is being looked up in those TCP connections.