Re: Reverse lookup flood from a single host

2011-07-18 Thread TCPWave Customer Care
Can you send the process table from your system? On Sat, 2011-07-16 at 10:06 -0400, Warren Kumari wrote: A related question (and apologies for the top post...) Does anyone know a good way to figure out the process that is making queries? Every 30 minutes or so I get 500 - 600 for around a

Re: Reverse lookup flood from a single host

2011-07-16 Thread Warren Kumari
A related question (and apologies for the top post...) Does anyone know a good way to figure out the process that is making queries? Every 30 minutes or so I get 500 - 600 for around a minute for 'vimes.kumari.net', on the machine called vimes, from 127.0.0.1. I realized that I was missing

Reverse lookup flood from a single host

2011-07-15 Thread Joshua Beard
Greetings, I've noticed a specific client machine doing a crap load of reverse lookups in my named logs. It's just reverse lookups for our internal network, and just from that machine. I can't see that this machine is looking up anything else, actually. Here's an example: 11-Jul-2011

Re: Reverse lookup flood from a single host

2011-07-15 Thread Chuck Swiger
On Jul 15, 2011, at 12:24 PM, Joshua Beard wrote: Greetings, I've noticed a specific client machine doing a crap load of reverse lookups in my named logs. It's just reverse lookups for our internal network, and just from that machine. I can't see that this machine is looking up anything

Re: Reverse lookup flood from a single host

2011-07-15 Thread Kevin Oberman
On Jul 15, 2011 12:36 PM, Joshua Beard j...@hewbert.com wrote: Greetings, I've noticed a specific client machine doing a crap load of reverse lookups in my named logs. It's just reverse lookups for our internal network, and just from that machine. I can't see that this machine is looking up

Re: Reverse lookup flood from a single host

2011-07-15 Thread Benny Pedersen
On Fri, 15 Jul 2011 13:24:29 -0600, Joshua Beard wrote: Is this abuse? If so, is it likely intentional? 100% guess, the client ip running a mailserver ? if so all is ok ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to