BIND 9 problem?

[Bill Manning]

% 
% 
% I'm running a BIND 9 Server on a solaris machine and I keep getting this
% message from my firewall:
% 10/26/2000 16:52:01.080 -       IP spoof detected -
% Source:172.16.2.8, 53, DMZ -    Destination:169.254.230.30, 137, WAN -
% -
% It is impossible for 169.254.230.30 to connect from the WAN for one
% thing, and another is the fact that that I have never found a route to
% get to that IP address
% Is this maybe a bug in BIND 9 that sends out packets to 169.254.230.30?
% I can't even resolve a domain name for that IP address....
% 
% Please help!
% 
% Thanks,
% Jacob

	169.254.0.0 is the prefix used for a node to autoconfigure
	an interface when it is told to use IP and no IP address is
	configured, either as a static assignment or via DHCP (where
	there is no DHCP server or the pool is exuasted).  This is 
	true for all current microsoft and apple products. One presumes
	your firewall, not knowing this makes a guess that the address
	is coming from "WAN", e.g. outside the firewall.  It is wrong.

	This has nothing to do with Bind, any version.

-- 
--bill