Re: Flood of bad DNS queries

[Jeff Kell <jeff-kell () utc edu>]

Jacques Bourdeau wrote:

> here, I blocked four /24 networks from Microsoft. 207.46.49.0/24 is one 
> of them. It begun during lasts days of september.
>
> 207.46.7 / 24
> 207.46.242 / 24
> 207.46.76 / 24
> 207.46.49 / 24

Is this anything like the "leakage" from the Broadband client?  We see 
leakage (blocked by anti-spoofing egress) of UDP (usually NTP) and ICMP 
with apparently "spoofed" AOL source addresses.  They haven't yet quite 
perfected their little "client tunneling" tricks yet.

Jeff


---------------------------------------------------------------------------
----------------------------------------------------------------------------