full-disclosure - Strange TCP/IP DNS traffic

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

From: list at rachinsky.de (Nicolas Rachinsky)
Subject: Strange TCP/IP DNS traffic

* Shachar Shemesh <fulldisc@....consumer.org.il> [2004-06-03 17:35 +0300]:
> The outbound traffic is not generated by the local bind installation, 
> which was asked to bind to port 53 for outbound traffic. Also, 

man named.conf:
  Query Address
     If the server doesn't know the answer to a question, it will query other
     nameservers.  query-source specifies the address and port used for such
     queries.  If address is * or is omitted, a wildcard IP address (
     INADDR_ANY) will be used.  If port is * or is omitted, a random unprivi-
     leged port will be used.  The default is
           query-source address * port *;

     Note: query-source currently applies only to UDP queries; TCP queries
     always use a wildcard IP address and a random unprivileged port.