blackhole.isi.edu and blackhole.ep.net

[Bill Manning]

% 
% 
% My nameservers have been having this ongoing converstation with
% blackhole.isi.edu and blackhole.ep.net.  After digging around isc.org's
% archives a little, and with some help ... Bill Manning's comments on RFC
% 1918 came into focus.
% 
% A snip from tcpdump ...
% 
% 10:00:59.005821 ns1.allianceresources.com.1039 > blackhole.isi.edu.domain:
% 4149 (42) (ttl 64, id 62598)
% 10:01:37.629468 ns1.allianceresources.com.1039 > blackhole.isi.edu.domain:
% 65391 (44) (ttl 64, id 62690)
% 10:01:57.626822 ns1.allianceresources.com.1039 > blackhole.isi.edu.domain:
% 1449 (46) (ttl 64, id 62710)
% 10:03:17.997817 ns1.allianceresources.com.1039 > blackhole.ep.net.domain:
% 15427 (45) (ttl 64, id 62832)
% 10:04:39.822077 ns1.allianceresources.com.1039 > blackhole.ep.net.domain:
% 47271 (45) (ttl 64, id 62885)
% 10:06:56.621324 ns1.allianceresources.com.1039 > blackhole.isi.edu.domain:
% 32406 (45) (ttl 64, id 63106)
% 
% What I surmise is that there someone asking ns1 to resolve a private ip, and
% since ns1 knows nothing about this reverse zone .. it turns to ask the
% servers that are .. all-la peanut-butter jelly sandwiches ... the request
% goes to the bit bucket.  I'm asking for affirmation here, does that sound
% right?  <grin>
% 
% If this is correct, a simple populated zone file and a HUP will knock this
% out.  However, when I inspected my other namesevers that do *not* front
% private address space ... the same queries are being made ... hrmmm .. now
% I'm stumped.
% 
% Am I missing something??
% 
% TIA
% 
% John Blue

blackhole.ep.net and blackhole.isi.edu are authoritative for the RFC 1918
space.  If your servers do recursion and they get a request for resolution
of RFC 1918 space, and they are Internet aware, they will punt to the 
root servers, who know about the authoritative servers... and will tell your
servers about where to go to get the answers.


-- 
--bill