Re: Interesting DNS Traffic

Andrew Fessler (andrewallegro.net)
Tue, 01 Jun 1999 09:19:20 -0500

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Next message: Brian Steele: "RE: Firewall comparison in Data Communications"
• Previous message: Technical Incursion Countermeasures: "Re: Portmapper service #s (was Re: Port Cheat Sheet)"
• Next in thread: Vern Paxson: "Re: Interesting DNS Traffic"
• Reply: Vern Paxson: "Re: Interesting DNS Traffic"

Unless I am being ignorant, doesnt this NOT comply with the RFC that
have to deal with return port numbers on all ip packets?

Andrew

>>> Robert Graham <robert_david_grahamyahoo.com> 5/31/99 6:38:36 PM
>>>
--- Andrew Fessler <andrewallegro.net> wrote:
> However, I see DNS requests and WWW requests come in where the
souce
> port on the packet originates in the 800 range rather than the
> standard 1024-65535 range. Therefore the reply back is denied.

The DNS traffic from low ports is somewhat normal, from my own
experience. I see LOTs of DNS traffic coming from ports lower than
1024
from machines browsing our website. Here are some example ports:

904 859 610 705 826 608 673 285 810 739 684 1 ???? 432 954 etc.

A lot of these are coming from machines that are themselves proxy
servers and firewalls, which I infer from the reverse DNS lookups
(the
names usually contain "fw" or "proxy"). One of them had the name
"fw1.etc.etc.", so this may be some "feature" of Checkpoint.

Rob.

_________________________________________________________
Do You Yahoo!?
Get your free yahoo.com address at http://mail.yahoo.com

• Next message: Brian Steele: "RE: Firewall comparison in Data Communications"
• Previous message: Technical Incursion Countermeasures: "Re: Portmapper service #s (was Re: Port Cheat Sheet)"
• Next in thread: Vern Paxson: "Re: Interesting DNS Traffic"
• Reply: Vern Paxson: "Re: Interesting DNS Traffic"

This archive was generated by hypermail 2.0b3 on Sat Jul 17 1999 - 07:18:59 CDT