[cobalt-users] Strange named behaviour

["Denis Bystruev" <bystruev@xxxxxxxxx>]

Hello,

I noticed a lot of inbound traffic on my RaQ 4
(http://www.rackshack.net/bandwidth/workdir1/216.40.212.243_13.html) and
while searhing for the one responsible I found that named asks for PTR
record every few seconds (my server is 99servers.com):

13:03:09.691424 www.99servers.com.1046 > ns1.ev1.net.domain: 53379+ PTR?
124.212.40.216.in-addr.arpa. (45)
13:03:09.691981 ns1.ev1.net.domain > www.99servers.com.1046: 53379 ServFail
0/0/0 (45)
13:03:09.692114 www.99servers.com.1046 > ns2.ev1.net.domain: 53379+ PTR?
124.212.40.216.in-addr.arpa. (45)
13:03:09.692555 ns2.ev1.net.domain > www.99servers.com.1046: 53379 ServFail
0/0/0 (45)

Is it normal?

Also I can't stop named.  '/etc/rc.d/init.d/named stop' does not stop it, I
still can see it running with ps ax.

Did someone hacked me?

--
Thanks,
Denis

$99 dedicated hosting directory http://99servers.com


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com