Hello,
Within the last month I have noticed a number of packets directed to port 53
on my home connection. The limited information from my router only reports
that inbound packets were directed to port 53 from > 1024 but not whether it
was UDP or TCP. I am getting around 50 hits per day in bursts from 5 to 30 at
a time from random sites.
I am running named internally but inbound connections from the internet are
blocked. The requests are coming from ISP's like level3.net but also from
non-ISP's like doubleclick.net.
Is anyone else seeing this? Could this be some type of worm attempting to
spread to DNS servers? I remember doubleclick being attacked with some type
of DNS denial of service a couple of months ago, could this be related?
Take care,
--
Rick Greep, Core Technologies, Inc.
RickGreep_at_cti-consulting.com
Phone: 877 293-2702
Public Key: 807E9BD3
_______________________________________________
firewall-wizards mailing list
firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Received on Feb 12 2005
Intro
