Network Gear that

[Erik Freitag]

> I've noticed some unpredictable behavior when doing queries from
> inside our network.
> 
> This includes the following:
>   dig some-name.com @ns.some-outside-server.com
> returns an INTERNAL address.
> 
> When I access a host from outside our internal network and do the
same
> thing, I get the expected address.
> 
> This leads me to believe that within the internal network, some
piece
> of network gear is intercepting my query and providing an answer it
> thinks should be provided.
> 
> We have mostly cisco gear, including pix firewalls.  Does anyone
know
> of network gear that would do that?  If it's a pix, where can one
find
> the settings for this?

Network Address Translation (NAT) on a router or a PIX will look inside
DNS response packets and apply the translation to the responses unless
overridden.