Lots of Unapproved AXFR's in the logs lately...anyone else?
Markus Stumpf
maex-bind-users at Space.Net
Tue Aug 29 14:33:29 UTC 2000
On Tue, Aug 29, 2000 at 12:51:43AM -0600, Nate Duehr wrote:
> What tool are you monitoring your number of AXFR requests with?
> Anything other than BIND's logging itself? Just curious.
It's a quick 'n dirty perl script that goes through the logfile once
a day.
Is sums up some lines from the security channel like:
[195.243.xxx.xxx] 4
* hotline.net (acl) 4 1
space.net (acl) 4 2
* xxxxx.net (not master/slave) 4 1
(3 axfrs from 195.243.xxx.xxx, 1 for hotline.net, 2 for space.net, 1 for
xxxxx.net; the asterisk marks unapproved, (acl) means denied by acl)
[195.30.xxx.xxx] 1
U* 30.195.in-addr.arpa 1 1
an "U" marks updates
If you'd like a copy (it's *really* quick 'n dirty) drop me a note.
\Maex
--
SpaceNet GmbH | http://www.Space.Net/ | Stress is when you wake
Research & Development | mailto:maex-sig at Space.Net | up screaming and you
Joseph-Dollinger-Bogen 14 | Tel: +49 (89) 32356-0 | realize you haven't
D-80807 Muenchen | Fax: +49 (89) 32356-299 | fallen asleep yet.
More information about the bind-users
mailing list