huge count of DNS deny hits

[babu dheen]

Dear All,
 
Today we have noticed one peculier issue in our firewall logs. We have internal DNS server running in bind which is protected by firewall. All clients are allowed to perform DNS lookup using our BIND internal DNS server( so only UDP 53 is allowed from LAN to DNS server in firewall)
 
But we noticed many DNS deny hits from BIND internal server to one client server (hit count around 6,00,00,000) in a day and the same time we saw around 5,00,000 allowed DNS lookup hits from that particular client to Internal DNS server.
 
Can you guide me in what situation this kind of problem can occur?
 
 
Regards
Babu
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20120108/bb26bccf/attachment.html>