[mdlug] Strange Log Entry

[Jay Nugent]

Greetings,

On Thu, 11 Apr 2013, A. Zimmer wrote:

> On Thu, 11 Apr 2013 22:46:05 -0400
> Aaron Kulkis <akulkis00 at gmail.com> wrote:
>
>>
>> Sounds like the other machine is sending bad packets.
>>
>
> I don't know a lot about networking (which is why I'm asking here)
> but UDP port 53 is for DNS related queries.  It seems that a DNS
> server (196.21.79.50) is responding to a request from 192.168.0.4
> with a bad packet.  But the address 192.168.0.4 does not exist
> on my network.  The only machine that is connected is 192.168.0.2,
> which is my Linux machine.  (My Windows box is shut off and when
> connected has a different address.)
>
> IOW, if my machine is sending DNS queries (and using pdnsd it is
> sending them) then the address for any responses from a DNS server
> should be 192.168.0.2.  Where us this 192.168.0.4 coming from?

    Nothing happens in IP atop 802.3 ethernet without ARP.  Check your arp 
table to determine the MAC address of the ethernet card that sent the 
packet.

       --- Jay

         () ascii ribbon campaign in
         /\ support of plain text e-mail

   Averaging at least 3 days of MTBWTF!?!?!?
  The solution for long term Internet growth is IPv6.
+------------------------------------------------------------------------+
| Jay Nugent   jjn at nuge.com    (734)484-5105    (734)649-0850/Cell       |
|   Nugent Telecommunications  [www.nuge.com]                            |
|   Internet Consulting/Linux SysAdmin/Engineering & Design              |
| ISP Monitoring [www.ispmonitor.org] ISP & Modem Performance Monitoring |
+------------------------------------------------------------------------+
  05:01:01 up 266 days, 14:22,  2 users,  load average: 0.11, 0.13, 0.14