Bind: heavy cpu load

[phn at icke-reklam.ipsec.nu]

Victor Escudero - Sun Spain - Technical Support Engineer <victor.escudero at sun.com> wrote:
> Hi gurus,

> We have just detected a lot of errors in our DNS servers with traces similar to:

> 12-Feb-2004 13:05:39.886 response-checks: info: bad referral 
> (xxx.yyy.zzz.in-addr.arpa !< uuu.xxx.yyy.zzz.in-addr.arpa) from [aaa.bbb.ccc.ddd].53

> besides we have seen some wrong answers messages:

> 12-Feb-2004 13:01:34.448 response-checks: info: wrong ans. name (domain.com != 
> server.domain.com)

> The overall effect is that our in.named process is consuming a lot of cpu cycles 
> trying to resolve some IPs that really don't exist.

> Until now everything was OK, so we suspect this is could be a virus attack or 
> similar.

> Does anybody ever seen something like that before?

> kind regards,
> Vic.

> PS: Please answer me directly, as I am not subscribed to this newsgroup.

Post here, get response here :-)


See "http://www.ipsec.nu/links/DNS-BIND-namedmessages.htm#idx_b" 
( Kevin O'Neil assembly of bind messages )

In short, it's not your server that is in error, it's only reporting
that some other namserver is configured bad.



-- 
Peter Håkanson         
        IPSec  Sverige      ( At Gothenburg Riverside )
           Sorry about my e-mail address, but i'm trying to keep spam out,
	   remove "icke-reklam" if you feel for mailing me. Thanx.