[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [FW1] Strange Log Entry
Title: RE: [FW1] Strange Log Entry
I questioned my ISP about the address and here's what they said:
Michelle,
We have a reverse entry for some of our non-routable IP's entered into our DNS
server. This is just handy for us internally. So your source is 172.16.1.130.
I guess that explains it.
-----Original Message-----
From: Steven Lee [mailto:[email protected]]
Sent: Thursday, January 04, 2001 4:10 PM
To: [email protected]
Subject: Re: [FW1] Strange Log Entry
First, turn off address resolution... you'll see that t130.uia.net is
actually 172.16.1.130 ( a private RFC1918 address). Are you
using 172.16 as an internal address?
Second, you should tell your ISP that they shouldn't be populating
their DNS with A records (and PTR records) for RFC1918 addresses.
Steve
[email protected] wrote:
>
>
> I'm looking through my FW1 log because our T1 is up and running, but we can't
> seem to get to the Internet, except email. I'm seeing entries in the log such
> as:
>
> Source Destination
> t130.uia.net msnbc.com
>
> The source is not from our network and the destination is not to our network,
> so why the heck would that source be coming to us to get to msnbc? BTW,
> uia.net is our ISP.
>
> Any ideas?
>
> Thanks, Michelle
> _____________________
> Michelle Johnston, MCSE4, CNE5
> Network Manager, NHRA
> [email protected]
--
Steven Lee, CISSP
Senior Network Security Engineer FAX
AVCOM Technologies, Inc. Pager
4636 E Marginal Way S, Ste B-100 http://www.avcom.com
Seattle, WA 98134-2383 mailto:[email protected]
