Were we poisioned, spoofed or something else?

S

Steve

Today, one of our internal DNS servers began reporting every host resolution
as an address that has been traced to somewhere in China. We are actively
trying to figure out what occurred. Replacing our actual domain with "test",
here is what we saw in nslookup or regular pings.

nslookup
www.test.com.test.com (china address)
validhost1.test.com
validhost1.test.com.test.com (china address)
invalidname1.test.com
invalidname1.test.com.test.com (china address)

What was happening?

TIA
 
A

Ace Fekay [MVP]

In
Steve said:
Today, one of our internal DNS servers began reporting every host
resolution as an address that has been traced to somewhere in China.
We are actively trying to figure out what occurred. Replacing our
actual domain with "test", here is what we saw in nslookup or regular
pings.
nslookup
www.test.com.test.com (china address)
validhost1.test.com.test.com (china address)
invalidname1.test.com.test.com (china address)

What was happening?

TIA

Try putting a period at the end of the query. Apparently it is suffixing
your search suffix and the period will stop that. Can you post an ipconfig
/all (unedited if you can please) so we can further evaluate your machine's
configuration?

Thanks,

--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations

Having difficulty reading or finding responses to your post?
Try using Outlook Express or any other newsreader, configure a news
account, and point it to news.microsoft.com. Anonymous access. It's
easy and it's free:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

"Life isn't like a box of chocolates or a bowl of cherries or
peaches... Life is more like a jar of jalapenos. What you do today
may burn your butt tomorrow." - Garfield
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top