Bogus routes to host

[David Mitchell]

John Drummond <bind at omar.org> wrote:

> I think someone is polluting the DNS system.  I keep getting all these
> packets from real hosts, too -- but they're all stamped with the same 
> ethernet address. . .  I've already written CERT once.  

The ethernet address is a red herring - all the packets you see will contain
the ethernet address of the local router which forwarded the packet
onto the LAN your were running the sniffer on.


* Dave Mitchell, Operations Manager,
* Fretwell-Downing Facilities Ltd, UK.  Dave.Mitchell at fdgroup.com
* Tel: +44 114 281 6113.                The usual disclaimers....
*
* Standards (n). Battle insignia or tribal totems