telia.net

telia.net sends unsolicited packet to server and slow it down

[Penguinsnob]

hi, this is off topic here, but i just thought you might know something about what this is about... here is the log:

1,[29/Sep/2003 15:50:03] Rule 'Packet to unopened port received': Blocked: In UDP, internresolver1.se.telia.net [62.20.216.3:50113]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:06] Rule 'Packet to unopened port received': Blocked: In UDP, internal-dns5.telia.net [62.20.216.37:61666]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:08] Rule 'Packet to unopened port received': Blocked: In UDP, internresolver3.se.telia.net [62.20.216.8:61850]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:12] Rule 'Packet to unopened port received': Blocked: In UDP, internresolver3.se.telia.net [62.20.216.8:61850]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:15] Rule 'Packet to unopened port received': Blocked: In UDP, internal-dns4.telia.net [62.20.216.7:50267]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:22] Rule 'Packet to unopened port received': Blocked: In UDP, internresolver3.se.telia.net [62.20.216.8:61850]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:29] Rule 'Packet to unopened port received': Blocked: In UDP, internal-dns5.telia.net [62.20.216.37:61666]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:43] Rule 'Packet to unopened port received': Blocked: In UDP, internresolver1.se.telia.net [62.20.216.3:50113]->localhost:53, Owner: no owner
1,[29/Sep/2003 15:50:46] Rule 'Packet to unopened port received': Blocked: In UDP, internal-dns5.telia.net

[Romeo]

well, 9 short packets within 40 seconds should not result in a measurable slow down at all.
Several servers (look like nameservers themselves) in the telia net think there shold be a DNS nameserver answering on port 53 on your side.
As you don't give details about your operating environment I don't have an idea, what may be the reason for this.

Regards,
R.

[Penguinsnob]

i run windows 2003 server and host web sites, and telia.net sends me this series of packet for the last 2 weeks, continuously. my name server is registered at internic, and hosted on my server. if you see this thing going on in real time, they sends a packet every seconds or something (actually)

what do you mean by operating envrironment?

sorry, i am more of activist type than network administrator.

[Romeo]

Hi Penguinsnob,
with "operational environment" I meant more details about your setup like you told in your second post: are you hosting an own DNS server, etc.
OK, so you have configured your domain being served by an own DNS server right on your box. Then you should expect and accept incoming DNS queries to your server on both port 53 TCP as well as UDP, so the telia requests seem formally OK (assumed they are lookup requests on your domain's zone data). What is still unclear for me is why you see so much request just from telia -- are most of your visitors from Sweden?
From the log details ("unopened port") it seems to me that your DNS server is not listening on port 53 UDP at all, but it should.
As soon as your DNS would get and accept these packets, you wouldn't see these "blocked" log entries, while the traffic is still there, of course ...
Sorry, but I am not a Windows admin, so I can't give you more help here ...

Regards,
R.