Hi,
This traffic is blocked on the external interface of the firewall.
May 17 11:34:56.013614 rule 7/(match) block in on em1:
66.220.151.124.47369 xxx.yyy.ddd.zzz.53: 58106 NS? . (19)
May 17 11:34:56.763086 rule 7/(match) block in on em1:
66.220.151.124.47369 xxx.yyy.ddd.zzz.53: 58107 NS? .
Most likely that someone posted a link to a resource in your domain, and
your DNS appears to be an authoritative for that zone. Sounds quite
realistic. There on facebook might be some kind of parser trying to
retreive a preview for the link or something similar...
Anyway, have a look at the DNS
I wonder if these machines in the facebook.com domain are infected
with some malware bots?
Facebook *is* a malware bot:)
Let the request through and log what it tries to do next, this could be quite a
story.
-- p
Didn't take into account that you do not publish the DNS. That fact
makes my assumption wrong.
Really, go and log the requests! =)
17.05.2012 15:50, Siju George P=P0P?P8QP0P;:
This traffic is blocked on the external interface of the firewall.
--
Best regards,
Pavel Shvagirev
skype:
http://meetings.ripe.net/ripe-52/presentations/ripe52-plenary-dnsamp.pdf
On Thu, May 17, 2012 at 7:31 PM, Jonathan Gray j...@jsg.id.au wrote:
http://meetings.ripe.net/ripe-52/presentations/ripe52-plenary-dnsamp.pdf
Thankyou so much :-)
Siju
6 matches
Mail list logo
