RCODE (REFUSED)

Harry Putnam reader at newsguy.com
Wed Mar 1 11:29:08 UTC 2006


Running bind-9.3.2
I'm seeing quite a few lines like this in logs:
 (wrapped for mail)

  Feb 28 22:15:14 reader named[28465]: unexpected RCODE (REFUSED)
   resolving '60.206.94.211.in-addr.arpa/PTR/IN': 211.94.193.129#53

I might not have paid too much attention to that if it weren't for
this little item right next to it:

  Feb 28 22:15:18 reader sshd[3335]: Invalid user admin from
    211.94.206.60

This was a logsentry report, not the actual log so those lines
appeared next to each other.

Is the first a prelude in some way to an ssh hack of somekind?



More information about the bind-users mailing list