Zone Transfer Compromise

[EnemyAce]

Wondering if someone can help me do a little Detective work here. I suspect that a user on our network has been attempting to modify our DNS server, possibly by adding a URL to a site he created. I noticed a warning in Event Viewer, Event ID 6004.

The message stated; 'The DNS Server received a Zone Transfer Request from (Internal IP) for a non-existent or non-authoratative zone (URL).

The Internal IP is the address of one of our users. Was this person attempting to modify our DNS in some way? Any chance he was succesfull, or does this warning state as I believe that all is ok?

Dave

 

[chelenegro]

EnemyAce
That error doesn't necessarily mean that someone on purpose is trying to modify your DNS files. That internal IP (individual or device) might be running some kind of DNS deamon without even knowing. I'd suggest you traced it back if you can and HR allows and take a look into that system. I might be wrong though in the interpretation of the error message. Other input appreciated.

Jose Luis Martin Cenjor, CCNA, CCNP
HP Managed Services - WAN

http://www.hp.com