Re: Large number of DNS probes in last 24 hours

2008-06-02 Thread Michael Still
Jim Wise wrote: > On Fri, 30 May 2008, Michael Still wrote: >> I have seen PlanetLab experiments doing this. What are the originating >> IP addresses? > > Three observed source addresses > > 208.78.169.237 > 204.11.51.62 > 194.199.24.101 > > Source ports are high and non-repea

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread Jim Wise
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, 30 May 2008, Michael Still wrote: >Jim Wise wrote: >> I've seen a surprising number of attempted recursive DNS requests >> against unpublished non-recursive DNS servers in the last 24 hours or >> so, many of them obviously probes of some sor

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread Michael Still
Jim Wise wrote: > I've seen a surprising number of attempted recursive DNS requests > against unpublished non-recursive DNS servers in the last 24 hours or > so, many of them obviously probes of some sort (query for "." IN NS, > eg). > > Is anyone else seeing this? Is it new? Or did some botn

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread John Menerick
I have seen this as well on my fringe IP-space networks. Just a botnet or two running along the range. A cost of doing business :\ John Menerick http://icehax.us On May 30, 2008, at 10:11 AM, Lynda wrote: Jim Wise wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've seen a surpris

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread Lynda
Jim Wise wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've seen a surprising number of attempted recursive DNS requests against unpublished non-recursive DNS servers in the last 24 hours or so, many of them obviously probes of some sort (query for "." IN NS, eg). Is anyone else see

Large number of DNS probes in last 24 hours

2008-05-30 Thread Jim Wise
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've seen a surprising number of attempted recursive DNS requests against unpublished non-recursive DNS servers in the last 24 hours or so, many of them obviously probes of some sort (query for "." IN NS, eg). Is anyone else seeing this? Is it new