I don't see any tcp connect attempts, only udp. I also don't see any
connects to port 53.
-- Joe
At 05:00 PM 10/25/99 -0400, Rich Schaller wrote:
>If it's coming from Exodus, they may be using F5's 3dns server which does
>a null socket connect to your local dns servers using tcp to get rtt and
>latency. They (f5 3dns) uses this information to get the best response
>time and will load balance their servers behind accordingly. In your logs
>you will see port connects to tcp 53.
>
>Rich
>
>On Mon, 25 Oct 1999, Joe Matusiewicz wrote:
>
> > At 11:07 AM 10/25/99 -0500, Eric wrote:
> > >Joe Matusiewicz wrote:
> > > >
> > > > Are the source ip addresses from exodus.net?
> > >
> > >Yes. Always without a reverse lookup, too.
> > >
> > >Eric Johnson
> >
> >
> > I've first noticed them about three weeks ago. They look sort of like
> > traceroutes, but instead of the timestamp of each of the packets getting
> > incremented by a couple of seconds, they all have the same
> timestamp. They
> > originate from at least 5 servers in the exodus.net address space and they
> > target dns servers. I wrote to exodus and they told me that it was due to
> > Real servers that are negotiating ports for a better connection with my
> > users who are running RealAudio at their desktop. I would have believed
> > this if they were going to regular hosts, but these go to our dns
> > servers. Our dns servers are *nix and only run BIND.
> >
> > But somehow RealAudio is involved. I looked at the ip addresses that do
> > these "traceroutes" and see that they are on the same networks that
> some of
> > my users' Real servers. I think it is some new program that "measures
> > latency" by banging on your dns such as the Global Dispatch software
> > discussed here a while back.
> >
> > -- Joe
> >
> >
> > -
> > [To unsubscribe, send mail to [EMAIL PROTECTED] with
> > "unsubscribe firewalls" in the body of the message.]
> >
>
>-
>[To unsubscribe, send mail to [EMAIL PROTECTED] with
>"unsubscribe firewalls" in the body of the message.]
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
