Re: Win2k Machine contacting Root Server???

On Fri, 24 Mar 2006 04:49:18 EST, somebody said:

(Sorry, am replying to a reply rather than orignal...)

> I recently ran "netstat" on my personal laptop (running Win2k) and was 
> shocked to see that it had been making TCP connections to the root servers 
> (to their domain port). I know that some DNS queries are performed using 
> TCP, but I find it somewhat disturbing that the root servers were 
> involved.

A common cause of this is if the Windows box has been told to register its
DHCP address in Active Directory, but the AD DNS isn't configured for that.
The box then goes and asks the root servers where to find the AD.

It's particularly a big problem for RFC1918 address spaces leaking out
of a corporate net.

Another big source of pollution is PTR lookups for 1918 addresses.

http://www.caida.org/publications/papers/2004/dns-pollution/
http://www.caida.org/publications/papers/2003/dnsspectroscopy-full/

And some 98% (yes, 98%) of the packets reaching a root nameserver are bogus:

http://www.caida.org/publications/papers/2003/dnspackets/

Makes you wonder how it keeps working at all....

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFEJGeIcC3lWbTT17ARAtptAJ4xpcRD55XPiRgUj8RkalVNdb4e6wCgwGVq
CUQx7E7sAiEOHt9lP/7d2eQ=
=zgCi
-----END PGP SIGNATURE-----