AW: bind is tries to connect an unknown host an port 137 ?!

Tilman Schmidt Tilman.Schmidt at sema.de
Fri May 19 13:38:25 UTC 2000


At 15:13 19.05.00 +0200, Nikolas Hagelstein wrote:
>  
> > Looks like a DNS reply. I'd suspect someone connected a laptop PC to
> > your LAN that had previously been connected to the Internet by dialin
> > and is still using the source address it had gotten from the ISP.
>
>The dialin ip didn't belong to the same network (194.x.x.x) <->
>(192.168.0.0) so
>the laptop IMHO would never reach the dns (no route to host).

Yes it would. I am seeing that all the time on my network here.
The laptop has two interfaces: the RAS interface, with address
194.117.253.245 in your case, and the Ethernet interface with
an address in net 192.168.0.0. So for a packet with source
194.117.253.245 and destination 192.168.0.202 the IP routing
algorithm sees that the destination is directly reachable over
the Ethernet interface and sends it out there, no problem at all.
The problem arises at the recipient side which tries to send
back an answer to a source address from which no packet should
ever have gotten in.

>  In addition a
>DNS reply 
>to port 137 seems strange to me....

That is indeed strange. But I have seen stranger things than that
from Windows PCs.

-- 
Tilman Schmidt          E-Mail: Tilman.Schmidt at sema.de (office)
Sema Group Koeln, Germany       tilman at schmidt.bn.uunet.de (private)




More information about the bind-users mailing list