Re: [sentinix-list] Anyone ever heard of darkprofits.net ordarkprofits.com?

Also, if you're using BIND named and that nameserver of yours isn't used as a 
public caching name server, you could easily set up ACLs for who can querry 
the name server.
See 
http://www.learninglinux.com/HOWTO/Linux+IPv6-HOWTO/hints-daemons-bind.html
for more info.

Or, you could do as I do, put the port 53 tcp/udp behind Netfilter's stateful 
firewalling (it probably breaks the ns standards though).

	Michel

On Monday 02 February 2004 20:26, Travis Albrecht wrote:
> More than likely those requests are coming from machines infected with
> Mimail, how to stop it... I would need to know more about your DNS server
> and environment.
>
> Sounds like you have the same server responding to queries for internal and
> external.  If it's BIND you could set it to respond only for zones for
> which it is authoritative, however that would break internal requests,
> unless you are running 2 nics
>
> See if this helps http://www.zytrax.com/books/dns/ch4/#stealth
>
> Travis Albrecht
>
> -----Original Message-----
> From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org] On Behalf Of
> Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
> Sent: Monday, February 02, 2004 1:00 PM
> To: The SENTINIX Mailing List
> Subject: [sentinix-list] Anyone ever heard of darkprofits.net
> ordarkprofits.com?
>
>
>
>
>
>
> Hi guys. I know this is the Sentinix mailing list but i am just wondering
> if i could get some help here. I found that my DNS server is being asked to
> make numerous resolutions of darkprofits.com and darkrpofits.net. None of
> my internal clients are making these requests. My Sniffer shows me that the
> requests are being made from outside my network and that my DNS server is
> making a request for this domain to external hosts. Does anyone know where
> this may be coming from and how to stop it?
>
>
> Regards
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix