Weird entries in LogWatch

[QatQat]

Hi everyone,

it is a month now since my logwatch report in the morning shows hundreds of entried like the ones below in the named section

network unreachable resolving 'ns2.sitewavegambling.com/A/IN': 2001:7fd::1#53: 1 Time(s)
    network unreachable resolving 'ns2.sitewavegambling.com/A/IN': 2001:dc3::35#53: 1 Time(s)
    network unreachable resolving 'ns2.sitewavegambling.com/AAAA/IN': 2001:500:3::42#53: 1 Time(s)
    network unreachable resolving 'ns2.sitewavegambling.com/AAAA/IN': 2001:7fd::1#53: 1 Time(s)
    network unreachable resolving 'ns2.sitewavegambling.com/AAAA/IN': 2001:dc3::35#53: 1 Time(s)
    network unreachable resolving 'ns2.surfnet.nl/A/IN': 2001:610:0:800c:195:169:124:71#53: 1 Time(s)
    network unreachable resolving 'ns2.surfnet.nl/A/IN': 2001:610:0:800d::2#53: 1 Time(s)
    network unreachable resolving 'ns2.surfnet.nl/AAAA/IN': 2001:610:0:800d::2#53: 1 Time(s)
    network unreachable resolving 'ns2.telemar.net.br/A/IN': 2001:12f8:1::10#53: 1 Time(s)
    networ

The network is working fine and generally, unless the queries above refer to some banner on legit websites, noone on the network is querying those sites.


What can be happening?


QaTQat

If I could have sex each time I reboot my server, I would definitely prefer Windoz over Linux!

 

[BadBigBen]

Could be banner ads, could be malware...

run a HiJackThis Log and post it here for our Perusal...

I would also suggest to turn of IPv6 (it is not widely used at present and on IntraNets not useful)...

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[QatQat]

IV6 is off and we don't have any windoz client on the net.

QatQat

If I could have sex each time I reboot my server, I would definitely prefer Windoz over Linux!

 

[BadBigBen]

Sorry, 'bout the HJT... DUH!...

note to self: Linux not Windoze...





Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[stfaprc]

someone trying to do a DNS resolution using your DNS?

 

[QatQat]

I also had that feeling but port 53 is closed from outside.

The DNS serves only our network


QatQat

If I could have sex each time I reboot my server, I would definitely prefer Windoz over Linux!

 

[stfaprc]

might be time to get out the wireShark and see if anyone is doing something they are not aware of.

 

[QatQat]

What is very strange is that I get those entries also on saturday and sunday, when nobody is on the network.

From what I noticed, it all started after running an update.

Distro is F9.

this machine should not really be acting as a server but our CentOS srv has been down for a while with a controller fault and a F9 client has been doing pretty well as server, a part from this weird log messages.
Could it be a broken/buggy package?

After all F9 update policy is quite scary and often buggy packs get into the repo.The problem is that I have not found anything on the net about a potential broken package.

QatQat

If I could have sex each time I reboot my server, I would definitely prefer Windoz over Linux!

 

[stfaprc]

hmm, maybe it is a program that does blacklisting and it is trying to access these machines to get a database update?