From owner-freebsd-questions Mon May 18 10:31:08 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id KAA19859 for freebsd-questions-outgoing; Mon, 18 May 1998 10:31:08 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from lucy.bedford.net (lucy.bedford.net [206.99.145.54]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id KAA19845 for ; Mon, 18 May 1998 10:30:51 -0700 (PDT) (envelope-from listread@lucy.bedford.net) Received: (from listread@localhost) by lucy.bedford.net (8.8.8/8.8.8) id NAA09934; Mon, 18 May 1998 13:29:40 -0400 (EDT) (envelope-from listread) Message-Id: <199805181729.NAA09934@lucy.bedford.net> Subject: Re: Somewhat off-topic: Port 54 DNS Queries??? In-Reply-To: <01BD8248.90CB9840@w3svcs.mfn.org> from "J.A. Terranson" at "May 18, 98 10:34:40 am" To: sysadmin@mfn.org (J.A. Terranson) Date: Mon, 18 May 1998 13:29:40 -0400 (EDT) Cc: sysadmin@mfn.org, dima@zwb.net, freebsd-questions@FreeBSD.ORG Reply-to: djv@bedford.net From: CyberPeasant X-Mailer: ELM [version 2.4ME+ PL38 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG J.A. Terranson wrote: > > I *know*, that's why I'm asking! It appears (from several replies) > that these packets *might* be from misconfigured Novell systems (who > use XNS as the basis for their own auth schemes)... > > ---------- > From: Dima Dorfman > Dunno, but DNS uses UDP/53, not 54. 54 is registered to "XNS > Authentication?" > > > We have recently been rejecting a *ton* of udp packets from port > 54 > > that purport to be DNS queries. Does anyone know what's going on > > here? Can you track down the host that's sending them? Maybe with netstat, or for sure with tcpdump. Dave To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message