On 2. Jan 2012, at 22:16 , [email protected] wrote: >>>> Does such traffic actually occur in the wild, or would it only be used >>>> in attacks? >>> >>> Such traffic absolutely occurs in the wild. I have three reasonably >>> busy name servers where this is logged as an error from the ipfw code, >>> e.g. >> >> and I know of a couple of more people who have seen it and have ways to >> trigger it with legitimate servers. I have never tracked things down >> in more detail at some point back. > > If anybody would like to track down this, I can supply pcap data.
You'd need to go to the origins most likely and get into touch with them, ask them, work with them to identify things and see if you can find a common denominator... It might really be worth doing so; in case we are hunting misconfigurations or bugs here and discussing the merits on how to handle other than drop;-) /bz -- Bjoern A. Zeeb You have to have visions! It does not matter how good you are. It matters what good you do! -------------------------------------------------------------------- IETF IPv6 working group mailing list [email protected] Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 --------------------------------------------------------------------
