While idly reviewing event logs I saw something new (to me) this morning.
Event Type: Information Event Source: DNS Event Category: None Event ID: 5504 Date: 9/8/2009 Time: 8:38:09 AM User: N/A Computer: MYSERVER Description: The DNS server encountered an invalid domain name in a packet from 220.127.116.11. The packet will be rejected. The event data contains the DNS packet.
I got a few mentioning that .107 address and several more for .109 as well. All within about a 5 second span of time. The event data isn't all that helpful (or is it?):
Data: 0000: 97 5b 80 05 00 00 00 00 [..... 0008: 00 00 00 00 ....
Now I'm curious... how could my internal AD domain server be getting packets from those external address(es)?