[CentOS] [OT] DNS queries issue

Thu Oct 4 21:48:01 UTC 2007
gjgowey at tmo.blackberry.net <gjgowey at tmo.blackberry.net>

I'm just spit balling, but this doesn't sound like good normal behavior.  Off handedly it sounds like a DNS poison or transfer attempt.  I'm not entirely certain a centos mailing list is a good venue for this question.  I would try asking in SecurityFocus.

Geoff
 
Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: Rick Barnes <linux at sitevision.com>

Date: Thu, 04 Oct 2007 17:42:19 
To:CentOS mailing list <centos at centos.org>
Subject: [CentOS] [OT] DNS queries issue


Hello,

I have a 2 bind nameservers on my network (both running C3.9). Over the
last 3 weeks, I've seen a significant increase in the amount of denied
cache queries to DNS service and I'm wondering if I should be worried or
if there's something I can do to resolve or prevent this.

I show millions of lines like:
Oct  4 11:49:30 dns1 named[878]: client 68.13.16.20#53535: query (cache)
denied

If I trim out those and the last message repeated lines, I go from a
messages log of 1.8GB to 1.3MB but 2 weeks earlier my messages log for
the week was only 339M.

Googling for the query (cache) denied didn't seem find anything useful,
that this is other name servers attempting to query my servers for info.

Its this something I need to bear with in having a publically available
DNS server with authoritative domains? Is there a way to suppress these
messages from going to syslog and is it a bad idea to do so?

There have been no configuration changes except to add 1 or 2 domains to
the nameservers.

Any help in understanding this would be great.

Thanks,
Rick

_______________________________________________
CentOS mailing list
CentOS at centos.org
http://lists.centos.org/mailman/listinfo/centos