Lots of Unapproved AXFR's in the logs lately...anyone else?

Markus Stumpf maex-bind-users at Space.Net
Tue Aug 29 14:33:29 UTC 2000


On Tue, Aug 29, 2000 at 12:51:43AM -0600, Nate Duehr wrote:
> What tool are you monitoring your number of AXFR requests with?
> Anything other than BIND's logging itself?  Just curious.

It's a quick 'n dirty perl script that goes through the logfile once
a day.
Is sums up some lines from the security channel like:

[195.243.xxx.xxx]                                                     4
   *   hotline.net                                    (acl)           4 1  
       space.net                                      (acl)           4	2  
   *   xxxxx.net                         (not master/slave)           4	1  

(3 axfrs from 195.243.xxx.xxx, 1 for hotline.net, 2 for space.net, 1 for
xxxxx.net; the asterisk marks unapproved, (acl) means denied by acl) 

[195.30.xxx.xxx]                                                      1
  U*   30.195.in-addr.arpa                                            1 1  

an "U" marks updates

If you'd like a copy (it's *really* quick 'n dirty) drop me a note.

	\Maex

-- 
SpaceNet GmbH             |   http://www.Space.Net/   | Stress is when you wake
Research & Development    | mailto:maex-sig at Space.Net | up screaming and you
Joseph-Dollinger-Bogen 14 |  Tel: +49 (89) 32356-0    | realize you haven't
D-80807 Muenchen          |  Fax: +49 (89) 32356-299  | fallen asleep yet.



More information about the bind-users mailing list