Subject: spurious updates

From: Randy Bush <[email-masked]>
Date: Mon, 28 Jan 2002 17:51:46 -0800

so why are all these spurious updates in my logs?  many hundreds a day.

28-Jan-2002 17:41:57.596 update: info: client 63.196.106.137#27581: updating zone 'psg.com/IN': update failed: LT-MURRAY.psg.com/A: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
28-Jan-2002 17:41:57.765 security: error: client 63.196.106.137#27584: update 'psg.com/IN' denied
28-Jan-2002 17:42:09.114 security: error: client 209.190.8.131#44326: update 'psg.com/IN' denied
28-Jan-2002 17:42:19.144 security: error: client 209.190.8.131#44331: update 'psg.com/IN' denied
28-Jan-2002 17:44:31.118 security: error: client 196.6.129.83#1180: update forwarding denied
28-Jan-2002 17:47:06.549 security: error: client 209.190.8.131#44336: update 'psg.com/IN' denied
28-Jan-2002 17:47:08.570 security: error: client 209.190.8.131#44340: update 'psg.com/IN' denied

randy

---

From: Kevin Darcy <[email-masked]>
Date: Mon, 28 Jan 2002 21:35:43 -0500

Windows 2000. Don't ask me where they get the domain names from; sometimes I think they just make them up at random. I get update attempts for domains we haven't used in years. Reverse domains too.

I've considered reporting these to the FBI as attempted hacking attempts.

                                                                                                                                        - Kevin

---

From: Chip Rosenthal <[email-masked]>
Date: Mon, 28 Jan 2002 21:18:21 -0600

On Mon, Jan 28, 2002 at 09:35:43PM -0500, Kevin Darcy wrote:
> Windows 2000. Don't ask me where they get the domain names from;

My dinky little nameserver for UNICOM.COM is getting flooded by dynamic
updates from the China Unicom network.  Of course, the never respond to
NOC and/or support queries.

I'm thinking of asking my upstream to install a couple of blackhole
routes for me.  *sigh*

-- 
Chip Rosenthal * http://www.unicom.com/ * <[email-masked]>
They're after my domain! * http://save.unicom.com/

---

From: Bruce Campbell <[email-masked]>
Date: Tue, 29 Jan 2002 16:06:12 +0100 (CET)

> sometimes I think they just make them up at random. I get update
> attempts for domains we haven't used in years. Reverse domains too.

Windows 2000 and (recent) friends will attempt to perfom a dynamic update
for both the domain _that the local administrator has configured_ and also
for _the IP address that it has been assigned_.

In Randy's case, its one of:

	*) lots of people like 'psg.com' (hence, lots of attempted updates).
or
	*) Their default search is '.com', and lots of people like 'psg'.
	   ( Haven't seen this myself )
or
	*) The logs are incorrect in recording an update attempt for
	   'psg.com' and are actually recording an update attempt sent
	   to a psg.com machine as it is a listed nameserver for a domain
	   that the local administrator has configured.  ( Actually they
	   try to contact the machine in the MNAME field of the SOA record )
or
	*) Something flakey (where they start off by trying to update a
	   domain that something.psg.com is a listed secondary for, but
	   end up attempting to update the 'psg.com' itself).

Note that Microsoft has some conditionals in the code to prevent them from
attempting to send dynamic updates to 'known' root servers.

-- 
                             Bruce Campbell                            RIPE
                   Systems/Network Engineer                             NCC
                 www.ripe.net - PGP562C8B1B                      Operations

---

From: Simon Coffey <[email-masked]>
Date: Tue, 29 Jan 2002 16:46:10 +0000

Hi

I've proposed a draft before that would reserve a TLD for use on private
networks,  for exactly this kind of reason - to stop internal DNS naming
structures leaking out to the internet in some way or another.    For example
if psg were using psg.pri as their internal win2k domain, (not .com) I don't
believe this sort of problem would occur.

(Oh, and yes, I'd prefer Win2k wouldnt do this kind of thing at all. But
it does.)

regards

Simon Coffey

Bruce Campbell wrote:

Randy Bush wrote:

end up attempting to update th
e 'psg.com' itself).

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: Bruce Campbell <[email-masked]>
Date: Tue, 29 Jan 2002 17:58:50 +0100 (CET)

On Tue, 29 Jan 2002, Simon Coffey wrote:

> structures leaking out to the internet in some way or another.    For
> example if psg were using psg.pri as their internal win2k domain, (not
> .com) I don't believe this sort of problem would occur.

urm, Randy is complaining about dynamic IP addresses from Hosts *outside*
his administrative control.  The problem is not with the psg end, but with
the sites that are referencing psg in some-to-be-determined manner.

If everyone did use a good naming schemes, we'd be happy.  If we, as
nameserver operators who get unwanted dynamic updates, were able to point
people at some sort of naming standard and say 'Fix it', we'd be happier.

The classic example of organisations making up their own standards and not
referencing others, is Microsoft's suggestion of 'Use "INT" for your
Internal naming structures'.  The nameservers for 'int.' thus get a nice
loading of dynamic updates.

Regards,

---

From: Simon Coffey <[email-masked]>
Date: Tue, 29 Jan 2002 17:21:24 +0000

>loading of dynamic updates.
Sorry, didnt figure that Randy *is* looking after psg.  As you say, my 
finger should be pointing at "some other guy" using psg in their domain, 
or borrowing psg's address range.

What I'd proposed in a draft was to reserve "pri." for internal 
networks, and then the "int." servers get a break, and everyones happy 
as we never have "pri." nameservers.

Anyway, I'll let you get back to the original discussion!

cheers
Simon Coffey

---

From: Randy Bush <[email-masked]>
Date: Tue, 29 Jan 2002 09:52:57 -0800

> Sorry, didnt figure that Randy *is* looking after psg.

yes, this particular server is the primary for psg.com.  and it serves as
secondary for a lot of other zones.  but psg.com is the only zone configured
to accept dynamic updates.  could it be that the updates were targeted for
other zones, and are incorrectly reported as being targeted to the only zone
for which dynupd is enabled?  that would explain a lot.

randy

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 29 Jan 2002 20:09:31 +0100

> for which dynupd is enabled?  that would explain a lot.

I don't think so.
We don't have updates enabled at all. We host some 10000+ domains and
I see updates from all over the world for a smaller range of different
zones. Some of those updates are surely customers where Win* tries to
update their own zone when they dial in.
But e.g. for "space.net" I see zillions of updates from all over the world
and we don't have customer hosts within space.net.

My guess would also be that the users choose some "kewl" names for
their host, because some domains like "space.net", "sf.com", "sonne.de"
(sonne = sun in German) or "blablubber.de" (blablubber = kinda "blah" in
German) see lot more updates than zones with longer and company specific
names.
Just as we see lots of bounces/marketing mails to  "[email-masked]"
or "[email-masked]". Users that don't want to leave their real email
address in web forms, but are required to do so, just type in something
they find "stupid" to express they don't like it, without noticing it
are real domains.

	\Maex

P.S. With the updates you could make profiles of the users on that hosts :-)
     You see them log in. You know how often, via which providers ...
     Funny ;-)

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
Stress is when you wake up screaming and you realize you haven't fallen
asleep yet.

---

From: Daniel Senie <[email-masked]>
Date: Tue, 29 Jan 2002 17:22:15 -0500

I don't think so.

I get the same messages about owl.com and jove.com, two domains I host for 
customers. I don't have dynamic updates configured for ANY domains I host. 
Several people have tried to steal, swindle or otherwise abscond with both 
of those domains. I've assumed the Win2K-generated traffic was just used by 
the same people who're trying to steal those domains.

Dan
-----------------------------------------------------------------
Daniel Senie                                        [email-masked]
Amaranth Networks Inc.                    http://www.amaranth.com