Re: Large number of DNS probes in last 24 hours

2008-06-02 Thread Michael Still
Jim Wise wrote: > On Fri, 30 May 2008, Michael Still wrote: >> I have seen PlanetLab experiments doing this. What are the originating >> IP addresses? > > Three observed source addresses > > 208.78.169.237 > 204.11.51.62 > 194.199.24.101 > > Source ports are high and non-repea

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread Jim Wise
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, 30 May 2008, Michael Still wrote: >Jim Wise wrote: >> I've seen a surprising number of attempted recursive DNS requests >> against unpublished non-recursive DNS servers in the last 24 hours or >> so, many of them obviously probes of some sor

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread Michael Still
Jim Wise wrote: > I've seen a surprising number of attempted recursive DNS requests > against unpublished non-recursive DNS servers in the last 24 hours or > so, many of them obviously probes of some sort (query for "." IN NS, > eg). > > Is anyone else seeing this? Is it new? Or did some botn

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread John Menerick
I have seen this as well on my fringe IP-space networks. Just a botnet or two running along the range. A cost of doing business :\ John Menerick http://icehax.us On May 30, 2008, at 10:11 AM, Lynda wrote: Jim Wise wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've seen a surpris

Re: Large number of DNS probes in last 24 hours

2008-05-30 Thread Lynda
Jim Wise wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've seen a surprising number of attempted recursive DNS requests against unpublished non-recursive DNS servers in the last 24 hours or so, many of them obviously probes of some sort (query for "." IN NS, eg). Is anyone else see