Re: [cobalt-security] named "denied update" error

["cpaul" <inc@xxxxxxxxxxxxx>]

> This situation is rather mysterious.
> I don't have any DNS relationship (nor anything else)
> with 157.238.135.154 -- I'd never seen this IP address
> before these messages started appearing in my log.
> I have no idea whose machine this is nor why it's
> attempting a zone transfer.
> 
> The last time my DNS server was modified was months
> ago;  nothing has changed recently at keller.com.
> My nameserver is ns.keller.com not ns2.
> I wonder how you were able to obtain that name.
> 
> The messages about 157.238.135.154 are appearing in
> my log at two or three minute intervals.
'

i recently experienced such an effect for over three
months.  i was able to contact the people through their
isp.  in my situation, there was a server on the ip
address running windows 2000, and the server was named
(eg for your case) KELLER.  windows 2000 server has an 
option in the LAN settings "Register this machine's
address in DNS".

well this setting basically hassles the authoritative
nameserver for KELLER.COM for nameservice all day every
day until they turn off that checkbox, or rename the
machine to something else (and reboot it a few times).

not saying that this is def. what is causing you this 
problem, but if you search google you'll find messages
all over the place about this particular windows 2000
"feature".

it was finding these messages that led me to approach
the isp who owned the ip address, who referred their
customer to me, who asked me to provide the info how
they could turn it off.


good luck :)



regards,

chris paul