<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
<br>Hi all, <br><br>For the first time my primary name server is not reporting any more<br><br>client XXX.XXX.XXX.XXX query (cache) './NS/IN' denied: 1 Time(s)<br><br>I use authfail on it to insert any IP attempting to ssh in, and failing more than three times. <br><br>I checked the current blocked IP address from the NS1 (name server), against the last list I saved, and this is the diff<br><br>> iptables -I INPUT -s 203.116.40.105/32 -j DROP <br>> iptables -I INPUT -s 75.98.70.11/32 -j DROP <br>> iptables -I INPUT -s 202.93.212.37/32 -j DROP <br>> iptables -I INPUT -s 41.222.10.230/32 -j DROP <br>> iptables -I INPUT -s 193.231.27.8/32 -j DROP <br>> iptables -I INPUT -s 75.102.10.231/32 -j DROP <br>> iptables -I INPUT -s 77.222.43.28/32 -j DROP <br>> iptables -I INPUT -s 67.205.103.187/32 -j DROP <br>> iptables -I INPUT -s 173.246.100.44/32 -j DROP <br>> iptables -I INPUT -s 147.102.208.41/32 -j DROP <br>> iptables -I INPUT -s 113.31.19.111/32 -j DROP <br><br><br>It has to be one or several of these IP address that are doing it. My NS2 (secondary name server) is still doing it. I'm going to upload the entire 3980 blocked IP's to it, and see if it stops. If it does, the offender has to be somewhere in this list. :)<br><br>Is there also a good test to check and see if I can / am poisoned?<br><br>Hope this helps,<br>Shawn<br><br><br> </div></body>
</html>