<div dir="ltr">One of the IPs ( 213.159.0.55 ) is an open PowerDNS recursor -- you could ask on the PDNS list, I've had great success getting intelligent responses from there.</div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Apr 2, 2013 at 6:37 PM, Jon Lewis <span dir="ltr"><<a href="mailto:jlewis@lewis.org" target="_blank">jlewis@lewis.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Tue, 2 Apr 2013, John Kristoff wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I never bothered to get to the bottom of it, but I'm still curious.<br>
Since it has been going on for years, presuming we're talking about the<br>
same thing, which I'm confident we are, I wonder if there is some<br>
specific custom code that is generating this stuff. Is it for a<br>
particular BL, BL user maybe? What else is in common? Any particular<br>
source network, node type? Maybe there is just some common code doing<br>
the look ups and it happens to pad the message with null bytes?<br>
</blockquote>
<br></div>
I've seen it for traffic to both Spamhaus and NJABL rbldnsd servers. The only commonality I noticed was the few that answered version.bind queries reported being Microsoft DNS. i.e.<br>
<br>
Microsoft DNS 6.1.7601 (1DB14556)<br>
Microsoft DNS 6.0.6002 (1772487D)<br>
<br>
Maybe someone at MS misread the RFC and thought 512 bytes was the minimum size permitted for a UDP DNS query. :)<br>
Maybe someone like this character:<br>
<a href="http://stackoverflow.com/questions/12083628/make-a-512-udp-bytes-dns-request" target="_blank">http://stackoverflow.com/<u></u>questions/12083628/make-a-512-<u></u>udp-bytes-dns-request</a><br>
<br>
Here's a list of servers seen sending such queries while I composed this message.<br>
<br>
66.162.165.171<br>
72.18.139.226<br>
202.71.102.164<br>
98.174.25.29<br>
50.76.25.65<br>
208.94.244.162<br>
209.200.117.169<br>
64.25.2.89<br>
195.178.14.46<br>
203.223.132.39<br>
23.25.209.82<br>
213.159.0.55<br>
68.179.124.241<br>
<a href="tel:68.179.84.153" value="+16817984153" target="_blank">68.179.84.153</a><br>
67.199.120.52<br>
202.157.186.216<br>
<a href="tel:202.71.103.16" value="+12027110316" target="_blank">202.71.103.16</a><div class="im HOEnZb"><br>
<br>
------------------------------<u></u>------------------------------<u></u>----------<br>
Jon Lewis, MCP :) | I route<br>
| therefore you are<br>
_________ <a href="http://www.lewis.org/~jlewis/pgp" target="_blank">http://www.lewis.org/~jlewis/<u></u>pgp</a> for PGP public key_________<br></div><div class="HOEnZb"><div class="h5">
______________________________<u></u>_________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.<u></u>net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/<u></u>mailman/listinfo/dns-<u></u>operations</a><br>
dns-jobs mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/<u></u>mailman/listinfo/dns-jobs</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Augie Schwer - Augie@Schwer.us - <a href="http://schwer.us" target="_blank">http://schwer.us</a><br>
</div>