Re: [cobalt-security] Active System Attack

[Jaana Jarve <netcat@xxxxxxxxx>]

On Tue, 11 Feb 2003, Achieve Website Design wrote:

> Can somebody explain what the following message in my Log Check reprt means.
> It has been appearing for the last 2 days, for one of my clients domains
> only. It has come from 2 separate IP addresses
>
> "Feb 11 08:59:09 ns named[419]: denied update from [xxx.xxx.xxx.xxx].1094
> for "clientdomain.com" IN"

hi,

it means your named received a dynamic update request from the IP in
question for the zone in question, and it was denied (as all these are,
unless explicitly permitted). some OS-es (win2000, notably) are very fond
of issuing such requests.

you can ignore these.

rgds,
netcat