DNS question

[Alex Pimperton]

Mark Nienberg wrote:
> I'm running a caching nameserver on my MailScanner machine.  For the
> last two days I have been seeing lots of these is /var/log/messages:
> 
> Aug  1 22:10:53 tesla named[18013]: dispatch 0x8face08: shutting down
> due to TCP receive error: 64.202.165.202#53: connection reset
> 
<snip>

There has been something very similar reported on NANOG in the last few
days:

> > Has anyone else seen an increase of the following named errors?
> >
> > Aug  1 01:00:09 morannon /usr/sbin/named[21279]: dispatch 0x4035bd70:
> > shutting down due to TCP receive error: unexpected error
> > Aug  1 01:00:09 morannon /usr/sbin/named[21279]: dispatch 0x4035bd70:
> > shutting down due to TCP receive error: unexpected error

> Noted similar here, started Jul 31 17:06:09 (GMT+1).

> > .. someone trying some new anti-bind trickery?

> The error can occur in "normal" usage of BIND9 so may reflect a change
> in
> firewall practice or similar.

> It is occurring on recursive servers with no remote recursive queries
> allowed,
> so it is presumably in response to some query initiated locally
> (email/spam
> related perhaps?).
>
> Suggest the DNS ops list may be best place to take further comments."

I'd try the DNS ops list and see if they've cracked it yet.

Regards,

Alex