Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 11 replies
  • Subscribers 2 subscribers
  • Views 27312 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

unexpected RCODE (REFUSED) resolving

scottj_01
All-

I upgraded from 8.102 to UTM 9.0 latest soft release. When I reviewed the DNS log this morning, the log was very full with the following Rcode entries:


2012:07:04-15:02:05 s_local_asl@OASIS named: Last message 'unexpected RCODE (RE' repeated 1 times, supressed by syslog-ng on OASIS
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '158.152.57.108.in-addr.arpa/PTR/IN': 71.252.0.72#53
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '158.152.57.108.in-addr.arpa/PTR/IN': 68.238.96.72#53
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '158.152.57.108.in-addr.arpa/PTR/IN': 151.203.0.87#53
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.38.10#53
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.34.10#53
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.32.10#53
2012:07:04-15:02:05 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.36.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.34.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.32.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.36.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '120.53.194.173.in-addr.arpa/PTR/IN': 216.239.38.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.34.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.36.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.32.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.38.10#53
2012:07:04-15:02:06 s_local_asl@OASIS named: Last message 'unexpected RCODE (RE' repeated 1 times, supressed by syslog-ng on OASIS
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.32.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.36.10#53
2012:07:04-15:02:06 OASIS named[4115]: unexpected RCODE (REFUSED) resolving '21.53.194.173.in-addr.arpa/PTR/IN': 216.239.34.10#53

The noted entries are from this afternoon. However they have been going on since last night. Everything on the network was down over night except the ASG. I am not able to find a LAN based source causing this. Can someone please provide some direction? Outside of this UTM 9 works very nicely, a job well done! I seems very odd this would be coming from the ASG, but I believe it is possible. The 173. ***.***.*** addresses are google, and there are some 108.***.***.*** that belong to verizon. Thanks in advance for any help provided!

Regards,
Jim


This thread was automatically locked due to age.
Parents
  • 0
    Barry,

    I have discovered a new twist to the DNS log issue. Eariler today I had my work laptop on my home network. From the time I took it off at 1147 until now I have been receiving the following DNS proxy log entry:2012:07:07-20:02:03 OASIS named[4115]: client 127.0.0.1#41428: RFC 1918 response from Internet for 6.1.168.192.in-addr.arpa. It is not there how can a responce be generated? There has to be something I am missing. We are working on 8 hours where a device that was removed from network is creating errors....... Some guidence is needed.

    Thanks,
    Jim[:O]
Reply
  • 0
    Barry,

    I have discovered a new twist to the DNS log issue. Eariler today I had my work laptop on my home network. From the time I took it off at 1147 until now I have been receiving the following DNS proxy log entry:2012:07:07-20:02:03 OASIS named[4115]: client 127.0.0.1#41428: RFC 1918 response from Internet for 6.1.168.192.in-addr.arpa. It is not there how can a responce be generated? There has to be something I am missing. We are working on 8 hours where a device that was removed from network is creating errors....... Some guidence is needed.

    Thanks,
    Jim[:O]
Children
No Data
Unfiltered HTML