strange connection attempts

GiZmen gizmen at pals.one.pl
Mon Apr 14 12:44:10 PDT 2003


> Hello,
> 
> > And i have plenty of strange connection attempts on udp protocol
> > 
> >  Connection attempt to UDP xx.xx.x.xxx:55414 from 192.43.172.34:53                                 
> >  Apr 13 23:56:53 pals /kernel: Connection attempt to UDP xx.xx.x.xxx:55414 from 192.43.172.34:53   
> >  Connection attempt to UDP xx.xx.x.xxx:12545 from 192.42.93.36:53                                  
> >  Apr 13 23:56:54 pals /kernel: Connection attempt to UDP xx.xx..xxx:12545 from 192.42.93.36:53    
> >  Connection attempt to UDP xx.xx.x.xxx:44308 from 192.42.93.36:53
> > 
> > i know that those connections are from dns but why kernel logs such thing.
> > I have statufull firewall and all trafic to any port on UDP protocol are deny and 
> > only those UDP datagrams from my resolver are passed back through dynamics rules. 
> 
>   Which is your ip address?  the "xxx" or the 192.42.93.36?
> 
>   If you're address is the "xxx" then you're fine.  DNS often uses the udp
>   protocol.
> 
>   However, if it's the other way around and your address is 192.42...
>   then, it means that the upstream DNS server is trying to get updates from
>   you.
> 
>   Are you running a DNS server yourself?
---end quoted text---

my address is "xxx" and 192.43..... is an expamle address of dns server.

I know that dns use an udp protocol but is it normal to have these connection
attempts??

Im running only local dnscache (from djbdns) on my box. I don have any dnsserver. 
I have plenty of such connections from dns servers, and i turned of sysctl
net.inet.udp.log_in_vain=0
because this starts to annoy me :(

-- 
Best Regards:
		GiZmen


More information about the freebsd-security mailing list