Results 1 to 4 of 4
  1. #1
    Join Date
    Jun 2005
    Posts
    697

    named: lame server (high numbers)

    We are getting a lot of the folloing errors:

    named[28334]: lame server resolving 'www.wombband.com' (in 'wombband.com'?): xxx.xxx.xxx.xxx#53
    named[28334]: lame server resolving 'www.wombband.com' (in 'wombband.com'?): xxx.xxx.xxx.xxx#53

    Normally I wouldn't be worried, but we started getting those yesterday, by now we have about 100000 requests (2/sec for each nameserver). They target one of our reseller (both his nameservers), the IPs at the end of the line are his nameserver IPs. We do not host wombband - never have. Wombband appears to be virus related traffic.

    Any idea how to fix this? Or should we just stop logging?
    ReflexNetworks means Happy Clients!

  2. #2
    Join Date
    Feb 2003
    Location
    North Hollywood, CA
    Posts
    2,554
    Why not ban the ip with iptables?
    Remote Hands and Your Local Tech for the Los Angeles area.

    (310) 573-8050 - LinkedIn

  3. #3
    Join Date
    Nov 2005
    Location
    Washington, DC
    Posts
    37
    I've seen a few of these..

    Dec 14 23:38:00 xx.xx.xx.xx named[11434]: lame server resolving 'www.tsappeal.org' (in 'tsappeal.org'?): xx.xx.xx.xx#53
    xx.xx. represents my ip address. Should I be worried or just ignore?

  4. #4
    Join Date
    Jun 2005
    Posts
    697
    Just ignore them. Except you really have a lot and they start to bog down your server. We had a period when DNS traffic was responsible for roughly 50% of our network traffic and named was the process with the highest CPU utilization. Then you sould start to worry, if it is just an occasional error then there is nothing wrong. You can actually turn the error reporting off it they worry you.
    ReflexNetworks means Happy Clients!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •