query-source

[Forrest Aldrich]

We had a problem with some abuse complaints, claiming that our DNS server 
was sending out suspicious probes to their machines (yeah, right).

What was actually happening, I believe, is what we've identified this 
evening (BIND 8.2.4):

Jul 11 23:24:57 dsm /kernel: Connection attempt to UDP 216.67.15.183:2004 
from 216.67.14.5:53

These are actually DNS queries.

While I don't understant the underlying reason that it does this (yet), I 
wonder if the option:

         query-source address * port 53;

would solve this problem. ?

Has anyone else encountered this.


Thanks....