request too small?

[Rainer Ginsberg]

Debie McFerrin (Debie.McFerrin at cpa.state.tx.us) wrote in
comp.protocols.dns.bind: 
> This particular message, according to
> F5, comes from their 3dns server simulating a zone transfer for data.

The 3dns server only opens the connection to measure Round Trip Time.

> I suggested
> that F5 make a detailed posting to this newsgroup for clarification and
> to keep the admin from worldres.com from getting a zillion e-mails.

There's a paper on Interpreting Network Traffic by Richart Bejtlich at 
http://www.securityfocus.com/templates/forum_message.html?forum=2&head=448&
id=448. 
In the section entitled A Final Case, he describes the exact network 
traces of F5's 3dns server and Cisco's Distributed Director.

Regards,
Rainer

-- 
Rainer Ginsberg
Robert Bosch GmbH
QI/INF4
Phone: +49-711-811-31263