[cobalt-security] named "denied update" error

[Dan Keller <dan@xxxxxxxxxx>]

Hello Cobalt Security Gurus --

I'm getting this error message in my log
several hundred times a day:

May 3 19:31:17 www named[671]: denied update from [157.238.135.154].9594 for "KELLER.COM"

Of course the timestamp changes, and so does the PID
(I assume that 9594 is a PID) but the rest of the message
is the same...  dozens every hour.

KELLER.COM is my domain and I run the primary
name server for it.

I'm guessing that an attempt to do a DNS zone transfer
is failing... but that's just a guess.

I can't find who owns 157.238.135.154 -- nslookup and dig
yield nothing.

Is it my named that's trying to reach 157.238.135.154 or is
it 157.238.135.154's named that's trying to reach mine?

Can anyone help me decipher this message?

And once I know what the problem is, what do I do about it?

Thank you in advance!

Dan Keller
dan@xxxxxxxxxx
http://www.keller.com/
+1 415 861-4500 (voice)
+1 415 861-4593 (fax)