DNS EVENT ID 5504

bjaxx

Event Type: Information
Event Source: DNS
Event Category: None
Event ID: 5504
Date: 8/20/2008
Time: 8:38:20 AM
User: N/A
Computer: xxx
Description:
The DNS server encountered an invalid domain name in a packet from 62.33.158.187. The packet will be rejected. The event data contains the DNS packet.



Well, I checked eventid.net

forwarding is turned off and cleared cache? Any reason why I would be getting these?

Did a dns lookup for ip - says its in russia?

stupidboy

I assume that we are talking about Windows 2003? Running SP2?

Have you read this http://support.microsoft.com/kb/920162?[/url]

bjaxx

stupidboy wrote:

I assume that we are talking about Windows 2003? Running SP2?

Have you read this http://support.microsoft.com/kb/920162?[/url]

yeah, I came across that article - not really much there...

I had forwarding turned on and was forwarding to my isp.

Don't know if this was a vulnerability or not, so I turned it off and checked the event viewer today and haven't had one since I made the change.

stupidboy

Check your log settings, the logs may have filled up! Give them a clear then check it in a hour or so (just to be sure).