"The DNS server encountered a packet addressed to itself on IP address 69.59.142.6. The packet is for the DNS name "aim-leads.com.". The packet will be discarded. This condition usually indicates a configuration error." [snip]
IIRC, this famous MS DNS error is well documented MS + Google and has several different causes.
My understanding is, this was most likely an attempt to hijack our DNS servers using cache corruption techniques
due to the various causes, I would not conclude first/only that it's sinister.
My two questions are:
1. Do any of you have tests that you run on your DNS servers to verify they are not vulnerable to cache corruption?
The first anti-cache pollution setting (any brand of DNS) is to turn off recursive service. no recursion = no cache = no cache pollution. The DNS is dedicated to serving zone data only.
The major security weakness in w2k DNS (vs BIND) is its inability to restrict recursive service to a group of permitted networks. It's recursion for everybody or nobody.
Separate your MS DNS servers into two groups:
1. for zones-only and has recursion off.
1.b the other group has recursion on but queries are restricted by non-DNS settings:
1.b.1 Firewall-block queries to the recursive DNS from internet.
1.b.2 have w2k DNS listen on a internal IP that is not accessible from internet.
2. Is there any course of action I can pursue to get these names to not point traffic to our name servers for their zone information, since we'll never have their zone info?
You can just ignore the traffic, no real harm done, until, like any traffic, it becomes too much. Simple queries alone won't hurt your DNS.
You can make your DNS servers authoritative for the zones that have been "pirate delegated" to your DNS servers, and return 127.0.0.1 for all A records, and use wildcards so all queries get an answer.
Len
_____________________________________________________________________ http://MenAndMice.com/DNS-training : Chicago; Wash DC; Atlanta http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
