Hello there,

All of a sudden I see some 2500 lines of "lame server resolving" messages in /var/log/messages on a low traffic web server (some 500-600 daily visitors), like this:
>>
May 23 16:58:35 host named[3441]: lame server resolving '130.159.46.66.in-addr.arpa' (in '130.159.46.66.in-addr.arpa'?): 207.167.223.53#53
>>
They started at 16:58:35 and seem like ended (for this turn?) at 17:31:47.

There are altogether some 500-600 different IP's referred to.

Is this an attack? If yes, what might be its target and how to defend it?

Server was newly, fully reinstalled after it had been rooted a few days ago. Kernel is 2.4.20-8, RH 9 with cPanel, no firewall installed.

Thank you very much for your thoughts.

edit you named.conf go the options section and add

logging {
category "lame-servers" {
"null";
};
};



restart bind. Btw i highly suggest you upgrade your kernel.

I would also suggest you install a firewall. Get APF for example which is fairly easy for most people to install.

how could I send the requests to an advertising page or page of my choosing?

hehe yes intersting... how to send all lame server requests to an adv page on my service?