Hi Mark,<br><br>Thank you every much for you help. I can solve the problem now.<br><br><div class="gmail_quote">On Thu, Feb 4, 2010 at 7:52 AM, Mark Andrews <span dir="ltr"><<a href="mailto:marka@isc.org">marka@isc.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im"><br>
In message <<a href="mailto:b4a3339c1002031612n5fd6395dy258959f605adbb4e@mail.gmail.com">b4a3339c1002031612n5fd6395dy258959f605adbb4e@mail.gmail.com</a>>, Makara writes:<br>
> Hi,<br>
><br>
> I'm dns administrator, please give me an excuse if it's not the right place<br>
> to ask the question. My dns server is attacked, below are the log<br>
<br>
</div>You are not being attacked. The zone 26.178.115.in-addr.arpa is<br>
delegated to you but you are not configured to serve it.<br>
<br>
26.178.115.in-addr.arpa. 86400 IN NS <a href="http://ns01.digi.com.kh" target="_blank">ns01.digi.com.kh</a>.<br>
26.178.115.in-addr.arpa. 86400 IN NS <a href="http://ns02.digi.com.kh" target="_blank">ns02.digi.com.kh</a>.<br>
<br>
You are seeing other nameservers performing reverse lookups on the<br>
address in 26.178.115.in-addr.arpa. This will usually be because<br>
you made a connection to a service which uses these servers for<br>
reverse DNS lookups for access control or just logging where the<br>
request came from.<br>
<br>
Either remove the delegation or serve the 26.178.115.in-addr.arpa zone.<br>
<br>
Mark<br>
<div><div></div><div class="h5"><br>
> Feb 4 06:26:29 ns01 named[7791]: client 204.194.238.15#42502:<br>
query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb<br>
4 06:26:29 ns01 named[7791]: client 196.14.64.145#54363: query<br>
(cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4<br>
06:26:29 ns01 named[7791]: client 66.33.216.129#58386: query (cache)<br>
> '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29<br>
ns01 named[7791]: client 62.141.32.3#10049: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 203.220.10.226#27558: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 117.102.98.253#4696: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 208.69.34.8#52506: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 64.27.31.126#23550: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 195.25.5.65#49345: query (cache) ><br>
'110.25.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 208.65.201.98#20322: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 82.108.95.210#2104: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 65.39.178.17#53701: query (cache) ><br>
'200.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: FORMERR resolving ' > <a href="http://ns1.pendingrenewaldeletion.com/AAAA/IN" target="_blank">ns1.pendingrenewaldeletion.com/AAAA/IN</a>':<br>
205.178.190.51#53 > Feb 4 06:26:29 ns01 named[7791]: unexpected<br>
RCODE (REFUSED) resolving ' > <a href="http://cheappaintballgunstore.com/A/IN" target="_blank">cheappaintballgunstore.com/A/IN</a>':<br>
74.53.26.66#53 > Feb 4 06:26:29 ns01 named[7791]: client<br>
85.115.52.190#24528: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN'<br>
denied > Feb 4 06:26:29 ns01 named[7791]: client 83.103.75.172#19067:<br>
query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb<br>
4 06:26:29 ns01 named[7791]: client 66.119.189.138#63190: query<br>
(cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4<br>
06:26:29 ns01 named[7791]: client 194.206.126.15#49858: query (cache)<br>
> '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29<br>
ns01 named[7791]: client 72.232.214.226#10860: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: FORMERR resolving ' > <a href="http://ns2.pendingrenewaldeletion.com/AAAA/IN" target="_blank">ns2.pendingrenewaldeletion.com/AAAA/IN</a>':<br>
205.178.190.51#53 > Feb 4 06:26:29 ns01 named[7791]: client<br>
83.243.8.6#26089: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN'<br>
denied > Feb 4 06:26:29 ns01 named[7791]: client 97.64.179.210#19383:<br>
query (cache) > '200.26.178.115.in-addr.arpa/PTR/IN' denied > Feb<br>
4 06:26:29 ns01 named[7791]: client 81.4.88.10#24179: query (cache)<br>
> '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29<br>
ns01 named[7791]: client 66.33.216.208#8796: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 66.119.189.138#34887: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01<br>
named[7791]: client 208.67.219.11#39638: query (cache) ><br>
'118.26.178.115.in-addr.arpa/PTR/IN' denied > > > I'm using BIND<br>
9.3.3rc2, any idea or advise how to solve the problem? it's ><br>
response so slow and some time is not response > -- > The person<br>
</div></div>who loves others will also be loved. -- Mark Andrews, ISC 1 Seymour<br>
St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742<br>
INTERNET: <a href="mailto:marka@isc.org">marka@isc.org</a><br>
</blockquote></div><br><br clear="all"><br>-- <br>The person who loves others will also be loved.<br>