• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1114
  • Last Modified:

Odd Event Logs, 'update 'adomain.com/IN' denied'

Error             client 83.170.31.199#1130: update 'adomain.com/IN' denied
Error             client 83.170.31.199#1130: update 'adomain.com/IN' denied
Error             client 83.170.31.199#1025: update 'adomain.com/IN' denied

We host 'adomain.com' we seem to be getting the above errors regularly in the Event Application Log

It looks like there is a process making a DNS request to the server. Can we block or stop the request, ideally before it gets to the event log, as it does fill it with errors.

Cheers
Mike
Error 		client 83.170.31.199#1130: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1130: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1025: update 'adomain.com/IN' denied
Information 	client 83.170.31.203#2255: updating zone 'adomain.com/IN': update unsuccessful: pc-niknami.adomain.com/A: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
Information 	client 83.170.31.203#1791: updating zone 'adomain.com/IN': update unsuccessful: pc-niknami.adomain.com/A: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
Information 	client 83.170.31.203#1651: updating zone 'adomain.com/IN': update unsuccessful: pc-niknami.adomain.com/A: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
Error 		client 83.170.31.199#1026: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1130: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1026: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#22269: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#22269: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1025: update 'adomain.com/IN' denied
Information 	client 12.160.37.210#53882: notify question section contains no SOA
Error 		client 83.170.31.199#1136: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1136: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#22260: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1130: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#22266: update 'adomain.com/IN' denied
Information 	client 83.170.31.203#4040: updating zone 'adomain.com/IN': update unsuccessful: pc-salahmand.adomain.com/A: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
Information 	client 83.170.31.203#4029: updating zone 'adomain.com/IN': update unsuccessful: pc-salahmand.adomain.com/A: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
Error 		client 83.170.31.199#22263: update 'adomain.com/IN' denied
Error 		client 83.170.31.199#1025: update 'adomain.com/IN' denied

Open in new window

0
mike99c
Asked:
mike99c
  • 3
  • 2
1 Solution
 
Netman66Commented:
It's telling you a non-domain computer is attempting to update a DNS record and is being denied.

It appears the name of the PC is "pc-nicknami" and "pc-salahmand".

It also doesn't look like an MS error - is this a BIND DNS server?
0
 
mike99cAuthor Commented:
Yes it is Bind, do you now how we can block the attempt, to stop it reaching the logs?
0
 
Netman66Commented:
It's already being blocked.  The Events are just so you know.  Personally, I'd want to know rather than ignore it.

Are these machines yours?  Maybe over VPN or something similar?

It's possible machines that are not yours are being attached to the network - would this be a possibility?


0
 
mike99cAuthor Commented:
We host the domain but we don't know who's machines they are.
They are not connected over VPN.
Not sure what they are doing, but we get these events every hour and it does fill the log.
Would be good to stop them somehow.
0
 
Netman66Commented:
On your firewall, block those 2 IP addresses or filter those ports out.  Right now it appears these two computers are attempting some sort of hack over multiple ports.  You should have some sort of filtering for inbound ports that are not required or an "allow" list of the few inbound that are.

Or notify the ISP that these guys are attempting to hack you.

0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now