Unusual bind behaviour

[Michael Best]

I have no idea what is up with this particular case:

Running Bind-8.2.2-P3-0.4.2 from Redhat.

Starting with this information:

Jan 18 13:08:11 xxxxx named[27754]: Malformed response from
[207.64.145.254].53 (out of data in final pass)
Jan 18 13:08:11 xxxxx named[27754]: bad referral
(251.145.64.207.in-addr.arpa !< 5
\00264\003207\007in-addr\004arpa\000\000\012\000\001\192\018\000\002\000\001\000
\001I\191\000\019\009blackhole\003isi.edu)
Jan 18 13:08:14 xxxxx named[27754]: bad referral
(251.145.64.207.in-addr.arpa !< 5
\00264\003207\007in-addr\004arpa\000\000\012\000\001\192\018\000\002\000\001\000
\001I\188\000\019\009blackhole\003isi.edu)

I did a little investigating:

A reverse lookup of 207.64.145.254 gives:
Authoritative answers can be found from:
168.192.in-addr.arpa    nameserver = blackhole.isi.edu
blackhole.isi.edu       internet address = 128.9.64.26
*** No address (A) records available for 207.64.145.254

or the previous weird result with the \000 lines in it.

A lookup of blackhole.isi.edu gives:
Non-authoritative answer:
Name:    blackhole.isi.edu
Address:  128.9.64.26

Traceroute to 207.64.145.254 goes to:
15  utd3-e0.the.net (129.117.1.245)  892.289 ms  906.634 ms  926.405 ms
16  * weatherford-isd.the.net (129.117.37.162)  908.655 ms *
17  207.64.145.254 (207.64.145.254)  913.401 ms  912.236 ms  930.584 ms

Traceroute to 128.9.64.26 goes to:
15  c7505.isi.edu (128.9.16.5)  99.357 ms  108.568 ms  101.329 ms
16  128.9.32.7 (128.9.32.7)  110.308 ms  101.723 ms  105.570 ms
17  blackhole.isi.edu (128.9.64.26)  104.900 ms *  101.444 ms

Needless to say this is quite strange, as I have not seen this in my
logs before.  

-Mike