repeated 16 hour interval spike in authoritative PTR lookups

jm9386 jm9386 at att.com
Fri Jan 11 17:36:58 UTC 2019


Ttl values for the arpa space is 4 hours.  It looks and feels like a
concerted nmap scan of arpa space hosted on our authoritative servers
triggered by a singular trigger.  Different sets of authoritative servers
hosting different arpa space are similarly seeing the same thing with an
offset 16 hour interval.  One of our large repositories sees 2 bursts, for
different arpa space each 16 hrs apart.



--
Sent from: http://bind-users-forum.2342410.n4.nabble.com/


More information about the bind-users mailing list