From owner-freebsd-security@FreeBSD.ORG Thu Jul 30 22:02:03 2009 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5211A106566B for ; Thu, 30 Jul 2009 22:02:03 +0000 (UTC) (envelope-from reichert@numachi.com) Received: from meisai.numachi.com (meisai.numachi.com [198.175.254.6]) by mx1.freebsd.org (Postfix) with SMTP id C38328FC13 for ; Thu, 30 Jul 2009 22:02:02 +0000 (UTC) (envelope-from reichert@numachi.com) Received: (qmail 74493 invoked by uid 1001); 30 Jul 2009 21:35:21 -0000 Date: Thu, 30 Jul 2009 17:35:20 -0400 From: Brian Reichert To: Roger Marquis Message-ID: <20090730213520.GC2506@numachi.com> References: <20090730120034.CD75610656CE@hub.freebsd.org> <20090730145817.C45772B2157@mx5.roble.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090730145817.C45772B2157@mx5.roble.com> User-Agent: Mutt/1.5.9i Cc: freebsd-security@freebsd.org Subject: Re: DNS probe sources X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2009 22:02:03 -0000 On Thu, Jul 30, 2009 at 07:58:17AM -0700, Roger Marquis wrote: > These source addresses are likely spoofed, but am still curious whether > other FreeBSD admins saw a preponderance of DNS probes originating from > Microsoft corp subnets ahead of the recent ISC bind vulnerability > announcement? Running djbdns here... > > Roger Marquis > -- Brian Reichert 55 Crystal Ave. #286 Daytime number: (603) 434-6842 Derry NH 03038-1725 USA BSD admin/developer at large