up vote 1 down vote favorite
share [g+] share [fb]

While idly reviewing event logs I saw something new (to me) this morning.

Event Type: Information
Event Source:   DNS
Event Category: None
Event ID:   5504
Date:   	9/8/2009
Time:   	8:38:09 AM
User:   	N/A
Computer:   MYSERVER
Description:
The DNS server encountered an invalid domain name in a packet from 72.233.33.107. The packet will be rejected. The event data contains the DNS packet.

I got a few mentioning that .107 address and several more for .109 as well. All within about a 5 second span of time. The event data isn't all that helpful (or is it?):

Data:
0000: 97 5b 80 05 00 00 00 00   —[€.....
0008: 00 00 00 00               ....

Now I'm curious... how could my internal AD domain server be getting packets from those external address(es)?

link|improve this question
97% accept rate
Did your DNS server query for an external address? In that case, it’s receiving data back as an answer to its own query. – Nate Sep 8 '09 at 16:38
Good point. All machines in the office point to this DNS server. It has forwarders setup (OpenDNS) for everything outside. So, in hindsight, I guess it makes sense that the events are likely in response to my server's request. – Chris_K Sep 8 '09 at 16:46
feedback

1 Answer

up vote 1 down vote accepted

I've seen this before on my own internal DNS servers. While I don't remember the exact cause, I believe that this is an incoming answer for DNS queries originating from your DNS server or answers coming from forwarders if you use forwarders. The answer has data that your server doesn't support (DNAME?).

Here's what I would do: Install a packet capture program on the DNS server, start a capture and filter for DNS, keep capturing until you see a new event in the event log, stop the capture and look for all traffic to and from the ip address in the event log, see if the packets are incoming DNS answers or incoming DNS queries.

link|improve this answer
I guess it would help if I read what others have posted before I add my two cents. I didn't notice that Nate and Chris_K said the same thing I said. Sorry. – joeqwerty Sep 8 '09 at 17:33
I'd wager you're correct in that this probably did originate from my server. The packet capture idea is a toughie though since I've only see this error once in the past 3 years! ;-) – Chris_K Sep 9 '09 at 0:06
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.