Subject: RE: Curious hosts reported in xferlog

From: Eric Cholet <[email-masked]>
Date: Fri, 9 Apr 1999 19:26:01 +0200

On Friday, April 09, 1999 1:49 PM, Michael Schmidt [SMTP:[email-masked]] wrote:
> 
> Hi,
> 
> when scanning our xferlog file I have found curious hosts there.
> Their names consist of (from left to right) an alphanumerical 
> part, then there is something looking like a 3 part IP number, 
> after this follows "in-addr.arpa"
> 
> For example:  hosta.hostb.123.123.123.in-addr.arpa
> 
> The above is only an example, number of the left host names and 
> the left host names themselves and the middle digits differ.
> 
> May be I'm too cautious, but what's that??
> Especially, what about the "in-addr.arpa" part?
> Can host names sent to wu-ftpd, or in other words received by 
> wu-ftpd, can these host names be hacked?
> 
It's also possible that those are IP's in a CIDR block that are
not being resolved correctly. Try resolving 195.80.134.34,
if the result is "34.134.80.195.in-addr.arpa" or
"34.0/26.134.80.195.in-addr.arpa", then your DNS resolver is at fault.

Hope this helps,
--
Eric