Sam at ChangeIP.com
Tue Dec 2 00:00:38 UTC 2008
> On Mon, 1 Dec 2008, Sam Norris wrote:
>> Just taking a quick poll about dns queries coming in on udp/49153. Does
>> anyone know what resolver is using this port, and why ?
> Hi Sam,
> I assume you're saying that 49153 is the destination port for what
> appears to be DNS messages hitting your authoritative nameservers,
> If so, can you show us how it looks in tcpdump (or wireshark?)
These are requests coming _to_ destination port 49153, not source ports.
This is why they stuck out, they are querying the wrong port for DNS. I
will put together some packet captures to share shortly. My guess is a
broken NAT or proxy device somewhere. I was trying to determine the user
agent so we could look into it more.
More information about the dns-operations