Re: Interesting DNS Traffic -Reply

Einar EINARSSON (einar.einarssoniea.org)
Wed, 02 Jun 1999 15:43:54 +0100

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Next message: pmsac: "SMTP relay tests"
• Previous message: Bernd Rudack: "sms and adsm over firewalls"
• Next in thread: Ge' Weijers: "Re: Interesting DNS Traffic -Reply"
• Reply: Ge' Weijers: "Re: Interesting DNS Traffic -Reply"

>>> Robert Graham <robert_david_grahamyahoo.com>
5/31/99 11:38 pm >>>

>The DNS traffic from low ports is somewhat normal, from
>my own experience. I see LOTs of DNS traffic coming from
>ports lower than 1024 from machines browsing our website.
>Here are some example ports:

I thought DNS lookup 'was supposed' to use a random
source port above 1023. So why are some implementations
using a source port below 1023 and some above 1023 ?
I guess there is nothing stoping the programmer, but
wouldn't it be simpler, at least for those writing packet filters,
if this stuff was implemented a certain way and not the other
?

Einar

• Next message: pmsac: "SMTP relay tests"
• Previous message: Bernd Rudack: "sms and adsm over firewalls"
• Next in thread: Ge' Weijers: "Re: Interesting DNS Traffic -Reply"
• Reply: Ge' Weijers: "Re: Interesting DNS Traffic -Reply"

This archive was generated by hypermail 2.0b3 on Sat Jul 17 1999 - 07:18:59 CDT