RE: Win2k Machine contacting Root Server???

Alex <[email protected]> Fri, 24 Mar 2006 09:49:46 -0600 (CST)
Newsgroups gmane.comp.security.incidents
Message-ID <Pine.LNX.4.64.0603240948410.32438@localhost>
Yes, I thought about this, but does it makes sense that it is contacting 
*the* DNS root servers???  I thought this was odd.

Thanks,

-Alex

On Fri, 24 Mar 2006, Adrian Marsden wrote:

> I believe you will find there is a setting that tells a Win2k server to try TCP if UDP fails for DNS resolution. Maybe the UDP was failing and the box was doing as it was told.
>
>
> -----Original Message-----
> From:	Alex [mailto:[email protected]]
> Sent:	Fri 3/24/2006 1:53 AM
> To:	[email protected]
> Cc:
> Subject:	Win2k Machine contacting Root Server???
>
> Hi,
>
> I recently ran "netstat" on my personal laptop (running Win2k) and was
> shocked to see that it had been making TCP connections to the root servers
> (to their domain port). I know that some DNS queries are performed using
> TCP, but I find it somewhat disturbing that the root servers were
> involved.
>
> I did a little googling and found a few remarks that Win2k machines
> sometimes do this...   But mine has the lastest updates....
>
> So I'm a little concerned.  Is this normal operation for a win2k machine,
> or could something more amiss be going on?    Norton Antivirus and SpyBot
> Search & Destory didn't find anything wrong.
>
> Thanks
>
> -Alex
>
> (I realize this is probably a normal thing,  but I still find it
> disturbing)
>
>
>
>