[ previous ] [ next ] [ threads ]
 
 From:  "Quark IT - Hilton Travis" <hilton at quarkit dot com dot au>
 To:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  FW: DNS information/error in event log
 Date:  Fri, 20 Aug 2004 11:43:16 +1000
Hi All,
 
I have noticed in our W2k3 SBS Error Logs the following types of errors,
starting at 2024 (local) last night.  Just thought I'd post this here in
case it is a m0n0wall bug - never seen these errors before.  I am
running 1.1b17 on a net4501 if that helps, and 1.1b17 has been running
since within about 24h of it being released.
 

________________________________

	
	
	DNS Log:
	Event ID: 5510

	The DNS server encountered a bad packet from 192.168.69.254.
Packet processing leads beyond packet length. The event data contains
the DNS packet.

	some more info  

	http://support.microsoft.com/default.aspx?scid=kb;en-us;841647
<http://support.microsoft.com/default.aspx?scid=kb;en-us;841647>   <--
read this as this is the relevant link from below. 

	and, from www.eventid.net <http://www.eventid.net>  here's some
more information... 

	
Event ID: 5501	
Source	 DNS <http://eventid.net/source.asp?source=DNS>  	
Type	 Error <http://www.eventid.net/docs/types.asp#Error>  	
Description	 DNS Server encountered bad packet from <IP Address>.
Packet processing leads beyond packet length. 	
Things to understand	 What is the role of a DNS server?
<http://eventid.net/subscribersonly.asp?feature=term>  	
Comments	 Ionut Marin
<http://eventid.net/contributorsdetails.asp?id=1579&eventid=5501&eventno
=477>  (Last update 7/4/2004): 
See Q841647 for a hotfix applicable to Microsoft Windows Server 2003.

Adrian Grigorof
<http://eventid.net/contributorsdetails.asp?id=1&eventid=5501&eventno=47
7>  
This event indicates that after sending a recursive query on behalf of a
client, DNS received a response with a fragmented flag set indicating
that the answer did not fit in one packet and that there is more data to
follow. See Q198757 and Q199792 for help in troubleshooting this
problem.  	
Links	 Q198757
<http://eventid.net/subscribersonly.asp?feature=qarticle>   (NT4)  , 
Q199792 <http://eventid.net/subscribersonly.asp?feature=qarticle>
(W2K)  , Q841647
<http://eventid.net/subscribersonly.asp?feature=qarticle>    (W2k3 - see
link above)  	
Search	 Microsoft Support
<http://eventid.net/subscribersonly.asp?feature=autolink>   -   
Microsoft Search
<http://eventid.net/subscribersonly.asp?feature=autolink>   -   Google
Groups <http://eventid.net/subscribersonly.asp?feature=autolink>   -   
Google Microsoft
<http://eventid.net/subscribersonly.asp?feature=autolink>   -   
EventID.Net Queue
<http://eventid.net/displayqueue.asp?eventid=5501&eventsource=DNS>   -
More links...
<http://eventid.net/buildlinks.asp?eventid=5501&source=DNS>  	
Various	 Send comments
<http://eventid.net/SubmitMoreInfo.asp?id=5501&Source=DNS&Index=477>
-    Notify me when updated
<http://eventid.net/subscriber.asp?eventno=477>  	

	 

	<http://www.quarkit.com.au/>  

	 
	 
	 
	 
	 
	 
	 
	 
	 
	 
	 
	 
	 
	 

  <http://www.quarkit.com.au/> 

http://www.threatcode.com/ <-- its now time to shame poor coders 
   into writing code that is acceptable for use on today's networks