Re: [FW1] domain-tcp drops

["jakevil ." <jakevil@FW1-NOSPAMhotmail.com>]

Greetings

I see the same thing, every day, from multiple source IPs (all being 
blocked, of course), all at about (within 5 seconds) the same time.  I see 
these logs on my CPFW at home, with a destination of my DNS server (only 
open to my internal networks.)  My best guess has always been that I have 
done a lookup against these DNS servers at some point in time, and based on 
the fact that they're all very different IP ranges, and the fact that they 
all hit me at the same approximate time, then they are likely compromised in 
some manner.  I really don't know this, though.

attention "Y M"
I would be interested if you'd be willing to share the list of IPs that are 
trying to connect to your DNS server. Feel free to filter out anything you 
want, but I'd be curious to see the Source IPs and times/dates (and what 
time zone your FW is in) for comparison.

If you're interested in swapping, feel free to email me directly.

regards
jakevil



> From: y m <fwmudyo@yahoo.com>
> To: fw-1-mailinglist@beethoven.us.checkpoint.com
> Subject: [FW1] domain-tcp drops
> Date: Tue, 21 Aug 2001 11:21:55 -0700 (PDT)
>
>
>
>
> Hi,
>
>
> In the firewall logs I see lot of domain-tcp drops
> with source being as different IP Addresses and
> Destination being our DNS server in DMZ .
> The DNS server in DMZ is used for resolving external
> domains .
> Is this because people are trying to do domain
> transfers or something else ?
>
> Thanks
>
>
> __________________________________________________
> Do You Yahoo!?
> Make international calls for as low as $.04/minute with Yahoo! Messenger
> http://phonecard.yahoo.com/
>
>
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ================================================================================


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp



================================================================================
    To unsubscribe from this mailing list, please see the instructions at
              http://www.checkpoint.com/services/mailing.html
================================================================================