出现了多条client:warning信息

nkvoid

dns-default.log中出现了多条如下信息：
Nov 01 17:11:14.861 client: warning: client 10.20.2.37#1601:error sending response: socket is not connected
Nov 01 23:30:29.701 client: warning: client 10.20.2.37#1126:error sending response: socket is not connected


什么意思呢？跟dns有关吗？
还有一条dispatch纪录：
Nov 01 05:33:07.283 dispatch: error: dispatch 22817d0: shutting down due to TCPreceive error: connection reset

目前dns正常运行。

abel

暫沒時間研究...
但個人認為這都和 TCP 有關,主要你要看那幾個 Client IP
和你的 DNS Server 有什麼具體的關係

nkvoid

出现的那些ip没有与我们的dns有什么特殊的关系，他们就是用我们的dns做域名解析。
我从网上查了dispatch error,只有一篇文章，理解起来有些困难：帮忙分析分析：
问题：
I'm getting at the daemon log These 2 errors - doe's anyone can help ?

Apr 24 17:33:42.776 dispatch: error: dispatch 4b407d0: shutting down due to TCP receive error: connection reset

Apr 25 10:41:16.777 dispatch: error: dispatch 4b407d0: shutting down due to TCP receive error: connection reset

回答：
When TCP makes a connection it does a 3 way hand shake

1.  SYN ->;  Request to establish a connection.
2.  <-- SYN ACK. Acknowledgement of request and a request to set up its own line of communication.
3.  ACK -->; Acknowledgement to the line of communication from the other side.
When TCP destroys the communication it uses usually a 4 way handshake.
1. FIN -->;  Request to destroy line of communication
2. <--- FIN Other side's request to destroy line of communication
3.  <---ACK  Acknowledgement of communication destruction.
4.  ACK--->;  Acknowledgement of communication destruction.

  In this case for some reason the other side is destroying the
communication via a reset RST.
1. RST -->;

This is unexpected by the bind server so it is aborting in its dispatch
module. It is likely that the problem is on the other side and that bind is just not handling the problem on its end very well.

Unless you find someone who has seen this before, the best approach may be to break out a sniffer and take a look at the conversation.
他的意思是不是当出现dispatch时，我的dns server会停掉，或不能好好的工作？但是我倒是没发现我的dns有什么异常。

这是被攻击的现象吗？

大侠，帮我分析分析亚。

abel

你若看成攻擊也可以,但量應不多,就還好
DNS TCP 請求多發生在 Zone Transfer 上,誰和你做 Zone Transfer 呢?
您只有這個 log 我也無法斷定是 Zone transfer , 另外, Query 亦有可能用 TCP , 但這不是常規

Reset 說明了你的 DNS 收到了一個 RST (TCP 的一個 flag),
通常會這樣多為 Firewall/NIDS 所產生的,您倒可再查查看您是否有這些
東西.

另外,就慣例而言,這個問題若連 http://groups.google.com/groups?hl=zh-TW&lr=&group=comp.protocols.dns.bind
都很少討論的話,大概就不算什麼大問題