unsolicited spam packets from DNS servers?
Mark_Andrews at isc.org
Mark_Andrews at isc.org
Tue Feb 25 03:11:12 UTC 2003
> I may have been unclear in my earlier message.
>
> Over a 2 minute period, almost 40% of my DNS traffic
> is unsolicited incoming messages from tld's. Why
> are tld's sending me random packets and how would I
> tell that the packets are 'authentic' vs. say, forged
> packets from 'outer space'?
>
> Is it really the case that no one knows?
>
> tnx,
> -l
I suspect that you are misclassifying reply traffic.,
> > -----Original Message-----
> > From: bind-users-bounce at isc.org
> > [mailto:bind-users-bounce at isc.org] On Behalf Of linda w
> > Sent: February 24, 2003 10:34a
> > To: bind-users at isc.org
> > Subject: Refining log output...getting closer ...
> >
> >
> > I'm working on a FW log processing script to make my life easier.
> > First thing this morning, I decided to take a look at what was happening
> > on the FW...of course, typical of Heizenberg's uncertainty principle,
> > the act of observing affects the results (looking at log causes name
> > lookups which in turn are recorded and cause more name lookups...:-))
> >
> > The below is a snippet of about 2 minutes of log traffic,
> > almost all of which is DOMAIN traffic.
> >
> > The items of note are the ones marked with "|<", representing =
> > blocked-incoming.
> > Notice there is a bunch! In fact out of the 285 lines below, 108 of them
> > are *blocked* incoming DNS traffic. So what's the "scoopage"? Is my
> > firewall being lame and closing off the window of of an acceptable
> > reply too soon? Should I just expect to receive random DNS
> > updates from
> > servers purporting to be 'special'?
> >
> > Looking at the first batch, b3.NSTLD.COM...seem to come out
> > of nowhere,
> > but look at that bunch from "j.gtld", A Bunch! And so it continues...
> > I ignore a bunch of incoming (I would presume) 'good' tld
> > info packets =
> > --
> > though it doesn't appear that any where "asked" for...(?)=20
> >
> > Is there other info I should be looking at to find out why I'm getting
> > these _seemingly_ unsolicited name requests (I'm guessing that I've
> > solicited them by inference, somewhere along the line, but dunno).
> >
> > Ideas on what I may be "missing" with these dropped packets?
> >
> > The "->" means permitted-outgoing, R/S are bytes received/sent.
> >
> > As an /unrelated/ side note -- I noticed tons of NETBIOS scans from
> > random hosts throughout the day -- seemingly hundreds....any idea why
> > that is?....I finally just filtered them out of the logs into the
> > bit bucket -- as my boxes aren't sending and have no NETBIOS
> > open ports.
> > Seems like such a 'clutter' with all those wasted packets coming in.
> >
> > Thanks....
> > Linda
> >
> >
> > HostA:logs> tail -f /var/log/traff.log|p
> > 20030224.0821,13 6 HostA:50567 -> b.root-servers.net:53;R: 617; S: 451
> > .0821,13 6 HostA:50568 -> c.root-servers.net :53 ;R:1086; S: 544
> > .0821,12 6 HostA:50571 -> f.root-servers.net :53 ;R: 617; S: 451
> > .0821,12 6 HostA:50569 -> d.root-servers.net :53 ;R: 617; S: 451
> > .0821,12 6 HostA:50570 -> E.ROOT-SERVERS.NET :53 ;R: 617; S: 451
> > .0821,13 6 HostA:50566 -> a.root-servers.net :53 ;R: 617; S: 451
> > .0821,11 6 HostA:50573 -> h.root-servers.net :53 ;R: 667; S: 415
> > .0821,11 6 HostA:50574 -> i.root-servers.net :53 ;R: 581; S: 415
> > .0821,16 6 HostA:50572 -> G.ROOT-SERVERS.NET :53 ;R: 773; S: 529
> > .0821,11 6 HostA:50575 -> j.root-servers.net :53 ;R: 617; S: 451
> > .0821,15 6 HostA:50576 -> k.root-servers.net :53 ;R: 765; S: 599
> > .0821,11 6 HostA:50577 -> l.root-servers.net :53 ;R: 617; S: 451
> > .0822 99 HostA:34118 |< b3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0750,1877 6 HostA:50489 -> m.root-servers.net :53 ;R: 74; S: 78
> > .0822,3 6 HostA:34118 -> j.gtld-servers.net :53 ;R: 247; S: 711
> > .0822,3 6 HostA:34118 -> m5.NSTLD.COM :53 ;R: 162; S: 75
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 229; S: 152
> > .0822,3 6 HostA:34118 -> ns2.psi.net :53 ;R: 172; S: 75
> > .0822,3 6 HostA:34118 -> f3.NSTLD.COM :53 ;R: 442; S: 77
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< l.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822,3 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 442; S: 474
> .0822,3 6 HostA:34118 -> a3.NSTLD.COM :53 ;R: 139; S: 88
> > .0822,4 6 HostA:34118 -> l.gtld-servers.net :53 ;R: 258; S: 634
> > .0822,2 6 HostA:34118 -> ;;Got bad packet: bad compression =
> > pointe:53;R:231;S:88
> > .0822,4 6 HostA:34118 -> ns.psi.net :53 ;R: 188; S: 75
> > .0822,4 6 HostA:34118 -> f3.NSTLD.COM :53 ;R: 229; S: 74
> > .0822 99 HostA:34118 |< g.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< g.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< g.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< g.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< g.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< g.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> > .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> > .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822,3 6 HostA:34118 -> j.gtld-servers.net :53 ;R: 226; S: 82
> > .0822,5 6 HostA:34118 -> g.gtld-servers.net :53 ;R: 247; S: 552
> > .0822,3 6 HostA:34118 -> a3.NSTLD.COM :53 ;R: 445; S: 784
> > .0822,3 6 HostA:34118 -> ns-ext.vix.com :53 ;R: 231; S: 88
> > .0822,3 6 HostA:34118 -> buchu.arin.net :53 ;R: 329; S: 488
> > .0822 99 HostA:34118 |< i.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< i.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< i.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< i.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< i.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> > .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> > .0822 99 HostA:34118 |< buchu.arin.net :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< l3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< l3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< j.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< m.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< m.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< m.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< m.gtld-servers.net :53 =20
> > .0822,2 6 HostA:34118 -> arrowroot.arin.net :53 ;R: 152; S: 91
> > .0822,2 6 HostA:34118 -> j.gtld-servers.net :53 ;R: 251; S: 80
> > .0822,2 6 HostA:34118 -> j.gtld-servers.net :53 ;R: 151; S: 233
> > .0822,2 6 HostA:34118 -> d3.NSTLD.COM :53 ;R: 239; S: 79
> > .0822,2 6 HostA:34118 -> ns.asml.com :53 ;R: 161; S: 72
> > .0822,2 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 239; S: 387
> > .0822,2 6 HostA:34118 -> E.ROOT-SERVERS.NET :53 ;R: 198; S: 91
> > .0822,2 6 HostA:34118 -> a3.NSTLD.COM :53 ;R: 445; S: 319
> > .0822,2 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 145; S: 87
> > .0822,2 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 444; S: 239
> > .0822,3 6 HostA:34118 -> i.gtld-servers.net :53 ;R: 250; S: 475
> > .0822,2 6 HostA:34118 -> buchu.arin.net :53 ;R: 329; S: 317
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< arrowroot.arin.net :53 =20
> > .0822 99 HostA:34118 |< d3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< d3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< d3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< m.gtld-servers.net :53 =20
> > .0822,3 6 HostA:34118 -> m.gtld-servers.net :53 ;R: 258; S: 395
> > .0822 99 HostA:34118 |< b.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< ns2.psi.net :53 =20
> > .0822 99 HostA:34118 |< ns2.psi.net :53 =20
> > .0822 99 HostA:34118 |< b.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< b.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< b.gtld-servers.net :53 =20
> > .0822,5 6 HostA:34118 -> arrowroot.arin.net :53 ;R: 333; S: 638
> > .0822,4 6 HostA:34118 -> ns03.army.mil :53 ;R: 274; S: 88
> > .0822,5 6 HostA:34118 -> ns2.net.umd.edu :53 ;R: 177; S: 79
> > .0822,5 6 HostA:34118 -> d3.NSTLD.COM :53 ;R: 226; S: 308
> > .0822,5 6 HostA:34118 -> m.gtld-servers.net :53 ;R: 164; S: 163
> > .0822,2 6 HostA:34118 -> ns4.verisign-grs.net :53 ;R: 288; S: 88
> > .0822,4 6 HostA:34118 -> ns2.nsiregistry.net :53 ;R: 287; S: 87
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< g3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< d3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< l3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< d3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< l3.NSTLD.COM :53 =20
> > .0822,4 6 HostA:34118 -> ns5.psi.net :53 ;R: 202; S: 86
> > .0822,4 6 HostA:34118 -> ns.fujisawa.wide.ad.jp:53 ;R: 212; S: 89
> > .0822,3 6 HostA:34118 -> b.gtld-servers.net :53 ;R: 250; S: 317
> > .0822,4 6 HostA:34118 -> b.gtld-servers.net :53 ;R: 155; S: 149
> > .0822,4 6 HostA:34118 -> ns2.psi.net :53 ;R: 197; S: 240
> > .0822 99 HostA:34118 |< ns5.psi.net :53 =20
> > .0822 99 HostA:34118 |< c.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< c.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< c.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< ns.psi.net :53 =20
> > .0822,12 15 HostA:50579 -> mailhost :mail ;R:rrrr; S:ssss
> > .0822,4 6 HostA:34118 -> d3.NSTLD.COM :53 ;R: 444; S: 319
> > .0822,3 6 HostA:34118 -> m.gtld-servers.net :53 ;R: 155; S: 75
> > .0822,4 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 445; S: 239
> > .0822,4 6 HostA:34118 -> b.gtld-servers.net :53 ;R: 251; S: 83
> > .0822,4 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 234; S: 229
> > .0822 99 HostA:34118 |< c.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< d3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< l3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< m3.NSTLD.COM :53 =20
> > .0822,3 6 HostA:34118 -> c.gtld-servers.net :53 ;R: 172; S: 153
> > .0822,3 6 HostA:34118 -> c.gtld-servers.net :53 ;R: 248; S: 237
> > .0822,3 6 HostA:34118 -> pri1.dns.psi.net :53 ;R: 227; S: 86
> > .0822,3 6 HostA:34118 -> pri3.dns.psi.net :53 ;R: 224; S: 86
> > .0822,4 6 HostA:34118 -> ns5.psi.net :53 ;R: 197; S: 160
> > .0822,3 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 445; S: 80
> > .0822,3 6 HostA:34118 -> ns.psi.net :53 ;R: 197; S: 160
> > .0822,3 6 HostA:34118 -> ns.psi.net :53 ;R: 197; S: 80
> > .0822 99 HostA:34118 |< b.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< a.gtld-servers.net :53 =20
> > .0822,4 6 HostA:34118 -> d3.NSTLD.COM :53 ;R: 444; S: 159
> > .0822,4 6 HostA:34118 -> m3.NSTLD.COM :53 ;R: 239; S: 154
> > .0822,4 6 HostA:34118 -> c.gtld-servers.net :53 ;R: 164; S: 160
> > .0822,4 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 445; S: 80
> > .0822,4 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 140; S: 91
> > .0822,4 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 445; S: 160
> > .0822 99 HostA:34118 |< f3.NSTLD.COM :53 =20
> > .0822 99 HostA:34118 |< a.gtld-servers.net :53 =20
> > .0822,3 6 HostA:34118 -> a.gtld-servers.net :53 ;R: 249; S: 159
> > .0822,3 6 HostA:34118 -> b.gtld-servers.net :53 ;R: 164; S: 156
> > .0822,4 6 HostA:34118 -> ns.psi.net :53 ;R: 197; S: 80
> > .0822,4 6 HostA:34118 -> gns1.nominum.com :53 ;R: 168; S: 91
> > .0822,3 6 HostA:34118 -> a.gtld-servers.net :53 ;R: 193; S: 159
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 138; S: 91
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 141; S: 92
> > .0822,3 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 142; S: 91
> > .0822,4 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 445; S: 80
> > .0822,3 6 HostA:34118 -> =
> > 166.160-175.44.124.64.in-addr.arpa:53;R:281;S:91
> > .0822,4 6 HostA:34118 -> f3.NSTLD.COM :53 ;R: 234; S: 155
> > .0822,3 6 HostA:34118 -> gns2.nominum.com :53 ;R: 173; S: 92
> > .0822,4 6 HostA:34118 -> buchu.arin.net :53 ;R: 333; S: 80
> > .0822,3 6 HostA:34118 -> d.gtld-servers.net :53 ;R: 250; S: 80
> > .0822,3 6 HostA:34118 -> a.gtld-servers.net :53 ;R: 171; S: 76
> > .0822,2 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 445; S: 80
> > .0822 99 HostA:34118 |< macu.ma.mt.np.els-gms.att.net:53 =20
> > .0822,3 6 HostA:34118 -> c.gtld-servers.net :53 ;R: 193; S: 79
> > .0822 99 HostA:34118 |< wycu.wy.br.np.els-gms.att.net:53 =20
> > .0822,3 6 HostA:34118 -> ns03.army.mil :53 ;R: 237; S: 90
> > .0822,3 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 149; S: 91
> > .0822,4 6 HostA:34118 -> ns.netscape.com :53 ;R: 206; S: 91
> > .0822,3 6 HostA:34118 -> ns1.crsnic.net :53 ;R: 276; S: 91
> > .0822,3 6 HostA:34118 -> ns2.nsiregistry.net :53 ;R: 274; S: 89
> > .0822,3 6 HostA:34118 -> noc.net.umd.edu :53 ;R: 261; S: 87
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 147; S: 89
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 155; S: 90
> > .0822,4 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 190; S: 90
> > .0822,4 6 HostA:34118 -> dmtu.mt.ns.els-gms.att.net:53;R:208;S: 90
> > .0822,4 6 HostA:34118 -> macu.ma.mt.np.els-gms.att.net:53;R:285;S:180
> > .0822 99 HostA:34118 |< d.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< d.gtld-servers.net :53 =20
> > .0822,4 6 HostA:34118 -> wycu.wy.br.np.els-gms.att.net:53;R:285;S:180
> > .0822 99 HostA:34118 |< ohcu.oh.mt.np.els-gms.att.net:53 =20
> > .0822,4 6 HostA:34118 -> d.gtld-servers.net :53 ;R: 262; S: 234
> > .0822 99 HostA:34118 |< d.gtld-servers.net :53 =20
> > .0822 99 HostA:34118 |< d.gtld-servers.net :53 =20
> > .0822,4 6 HostA:34118 -> pri2.dns.psi.net :53 ;R: 227; S: 85
> > .0822,4 6 HostA:34118 -> ns.ripe.net :53 ;R: 232; S: 91
> > .0822,4 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 441; S: 76
> > .0822 99 HostA:34118 |< a.gtld-servers.net :53 =20
> > .0822,3 6 HostA:34118 -> gns1.nominum.com :53 ;R: 153; S: 90
> > .0822,2 6 HostA:34118 -> d.gtld-servers.net :53 ;R: 218; S: 234
> > .0822,3 6 HostA:34118 -> d.gtld-servers.net :53 ;R: 209; S: 76
> > .0822,3 6 HostA:34118 -> d3.NSTLD.COM :53 ;R: 204; S: 92
> > .0822,3 6 HostA:34118 -> c3.NSTLD.COM :53 ;R: 160; S: 90
> > .0822,4 6 HostA:34118 -> sec2.dns.psi.net :53 ;R: 221; S: 86
> > .0822,4 6 HostA:34118 -> e5.NSTLD.COM :53 ;R: 232; S: 80
> > .0822,4 6 HostA:34118 -> pri3.dns.psi.net :53 ;R: 224; S: 86
> > .0822,3 6 HostA:34118 -> ns.above.net :53 ;R: 188; S: 98
> > .0822,6 6 HostA:34118 -> rs1.arin.net :53 ;R: 244; S: 77
> > .0822,4 6 HostA:34118 -> fraggle.speakeasy.net:53 ;R: 190; S: 90
> > .0822,3 6 HostA:34118 -> orcu.or.br.np.els-gms.att.net:53;R:305;S:91
> > .0822,4 6 HostA:34118 -> ns-wide.wide.ad.jp :53 ;R: 334; S: 91
> > .0822,3 6 HostA:34118 -> ohcu.oh.mt.np.els-gms.att.net:53;R:306;S:182
> > .0822,4 6 HostA:34118 -> =
> > 100.64/26.151.120.61.in-addr.arpa:53;R:208;S:91
> > .0822,3 6 HostA:34118 -> f3.NSTLD.COM :53 ;R: 203; S: 91
> > .0822,3 6 HostA:34118 -> gns2.nominum.com :53 ;R: 152; S: 89
> > .0822 99 HostA:34118 |< a.gtld-servers.net :53 =20
> > .0822,3 6 HostA:34118 -> a.gtld-servers.net :53 ;R: 237; S: 157
> > .0822,3 6 HostA:34118 -> orcu.or.br.np.els-gms.att.net:53;R:285;S:90
> > .0822,3 6 HostA:34118 -> a.gtld-servers.net :53 ;R: 205; S: 158
> > .0822,3 6 HostA:34118 -> dnsauth2.sys.gtei.net:53 ;R: 253; S: 79
> > .0822,3 6 HostA:34118 -> sec2.dns.psi.net :53 ;R: 226; S: 86
> > .0822,3 6 HostA:34118 -> pri1.dns.psi.net :53 ;R: 224; S: 86
> > .0822,3 6 HostA:34118 -> ns.above.net :53 ;R: 181; S: 91
> > .0822,3 6 HostA:34118 -> h.gtld-servers.net :53 ;R: 262; S: 77
> > .0822,4 6 HostA:34118 -> h.gtld-servers.net :53 ;R: 180; S: 74
> > .0822,4 6 HostA:34118 -> ns3.verisign-grs.net :53 ;R: 273; S: 88
> > .0822,4 6 HostA:34118 -> ns.netscape.com :53 ;R: 183; S: 90
> > .0822,4 6 HostA:34118 -> ns.vbns.net :53 ;R: 271; S: 74
> > .0822,3 6 HostA:34118 -> cbru.br.ns.els-gms.att.net:53;R:224;S: 89
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 182; S: 91
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 135; S: 91
> > .0822,4 6 HostA:34118 -> mx.arc.nasa.gov :53 ;R: 258; S: 86
> > .0822,3 6 HostA:34118 -> ns3.apnic.net :53 ;R: 92; S: 76
> > .0822,4 6 HostA:34118 -> dnsauth1.sys.gtei.net:53 ;R: 143; S: 90
> > .0822,4 6 HostA:34118 -> dnsauth2.sys.gtei.net:53 ;R: 221; S: 79
> > .0822,3 6 HostA:34118 -> h.gtld-servers.net :53 ;R: 221; S: 79
> > .0822,3 6 HostA:34118 -> g3.NSTLD.COM :53 ;R: 182; S: 91
> > .0822,3 6 HostA:34118 -> ns3.netsol.com :53 ;R: 195; S: 77
> > .0822,3 6 HostA:34118 -> rs2.arin.net :53 ;R: 232; S: 91
> > .0822,3 6 HostA:34118 -> fraggle.speakeasy.net:53 ;R: 191; S: 88
> > .0822,3 6 HostA:34118 -> rip.psg.com :53 ;R: 233; S: 91
> > .0822,3 6 HostA:34118 -> orcu.or.br.np.els-gms.att.net:53;R:306;S:92
> > .0822,3 6 HostA:34118 -> mango.itojun.org :53 ;R: 322; S: 91
> > .0822,3 6 HostA:34118 -> b3.NSTLD.COM :53 ;R: 441; S: 76
> > .0822,3 6 HostA:34118 -> f3.NSTLD.COM :53 ;R: 204; S: 92
> > .0823,3 6 HostA:34118 -> e.gtld-servers.net :53 ;R: 221; S: 79
> > .0823,3 6 HostA:34118 -> h.gtld-servers.net :53 ;R: 195; S: 150
> > .0823,3 6 HostA:34118 -> dns0.spin.ad.jp :53 ;R: 134; S: 91
> > .0823,3 6 HostA:34118 -> ns1.apnic.net :53 ;R: 232; S: 91
> > .0823 99 HostA:34118 |< m3.NSTLD.COM :53 =20
> > .0823,3 6 HostA:34118 -> ns1.netsol.com :53 ;R: 218; S: 92
> > .0823,4 6 HostA:34118 -> ns4.verisign-grs.net :53 ;R: 276; S: 91
> > .0823,3 6 HostA:34118 -> ns4.vbns.net :53 ;R: 180; S: 91
> > .0823,3 6 HostA:34118 -> orcu.or.br.np.els-gms.att.net:53;R:317;S:92
> > .0823,3 6 HostA:34118 -> dns0.telstra.net :53 ;R: 208; S: 78
> > .0823,3 6 HostA:34118 -> dns1.telstra.net :53 ;R: 203; S: 90
> > .0823,3 6 HostA:34118 -> a3.NSTLD.COM :53 ;R: 156; S: 92
> > .0823,3 6 HostA:34118 -> nasans4.nasa.gov :53 ;R: 331; S: 79
> > .0823,3 6 HostA:34118 -> mx.arc.nasa.gov :53 ;R: 355; S: 90
> > .0823,3 6 HostA:34118 -> tinnie.apnic.net :53 ;R: 276; S: 90
> > .0823,4 6 HostA:34118 -> ns.ntt.net :53 ;R: 212; S: 91
> > .0823,3 6 HostA:34118 -> l3.NSTLD.COM :53 ;R: 156; S: 91
> > .0823,3 6 HostA:34118 -> dnsauth2.sys.gtei.net:53 ;R: 228; S: 85
> > .0823,4 6 HostA:34118 -> dnsauth2.sys.gtei.net:53 ;R: 228; S: 85
> > .0823,3 6 HostA:34118 -> f3.NSTLD.COM :53 ;R: 172; S: 90
> > .0823,4 6 HostA:34118 -> c.gtld-servers.net :53 ;R: 195; S: 76
> > .0823,4 6 HostA:34118 -> h.gtld-servers.net :53 ;R: 178; S: 76
> > .0823,4 6 HostA:34118 -> rs1.arin.net :53 ;R: 237; S: 91
> > 12345678901234567890123456789012345678901234567890123456789012
> > 34567890123=
> > 4567890
> >
> >
> >
>
>
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark.Andrews at isc.org
More information about the bind-users
mailing list