Security Incidents: RE: DNS servers outbound connections.

[Philip Bartholomew <Philip.Bartholomew () cms co uk>]

I think your on the money there, David
Thanks, everyone who replied for you help.

Philip

"...isn't is odd that the word innuendo is so suggestive?..."

-----Original Message-----
From: NESTING, DAVID M (SBCSI) [mailto:dn3723 () sbc com]
Sent: 01 October 2002 16:06
To: 'Philip Bartholomew'
Cc: 'incidents () securityfocus com'
Subject: RE: DNS servers outbound connections.


There's no such thing as a UDP "connection" really.  Are you sure these
aren't DNS replies to requests made by these remote hosts?  

Frequently if a host tries to perform DNS resolution, it may end up querying
more than one server in an attempt to get a response.  If it gets a response
from one, it may tear down the UDP socket even though more than one server
was queried.  If there are any other replies that get delivered afterward,
they may get an ICMP Unreachable message generated when they arrive.  This
may make it seem like the DNS server is trying to send packets somewhere
they shouldn't be going.

If these are web servers, perhaps they have DNS resolution turned on in
their logging and you have a user on your network making HTTP requests
against these servers.

Just some thoughts..

David

From: Philip Bartholomew [mailto:Philip.Bartholomew () cms co uk]
> I wonder If any of you fine fellows can help. My 2 Nameservers are making
> a number of  UDP connections "10-20 a minute" originating on port 53 to
> alternating dest ports e.g.: 1113, 56008, 54002 tries about ten
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com