high-port queries - what do they do?

torben fjerdingstad unitfj-bind at tfj.rnd.uni-c.dk
Fri Jun 25 13:12:16 UTC 1999


I have limited recursive queries so they are only allowed
for us and our customers. Thanks for helping with that.
I see unapproved queries at a fast rate.

Now I wonder why about half of the queries are on high port
numbers. Does it look fine, or am I denying too much?

In the cases below, I have the zones "dk." and "225.130.in-addr.arpa.",
and not any of the subdomains mentioned here. Some queries go to
port 53,while others go to high ports. Why?

unapproved query from [193.162.146.9].4081 for "www.greenland-guide.dk"
unapproved query from [198.4.75.100].53 for "47.60.225.130.in-addr.arpa"
unapproved query from [206.197.81.10].33404 for "4.96.225.130.in-addr.arpa"
unapproved query from [209.162.64.15].32780 for "116.102.225.130.in-addr.arpa"

( timestamps removed to limit line length )

P.S. It's bind-8.1.2. I will upgrade very soon.

-- 
Med venlig hilsen / Regards 
Netdriftgruppen / Network Management Group
UNI-C          

Tlf./Phone   +45 35 87 89 41        Mail:  UNI-C                                
Fax.         +45 35 87 89 90               Bygning 304
E-mail: torben.fjerdingstad at uni-c.dk       DK-2800 Lyngby



More information about the bind-users mailing list